Cloud Security Engineer

Cloud Security Engineer

When to Use

• Design and implement org/account guardrails — SCPs, policy constraints, landing zone security
• Harden cloud IAM — roles, trust policies, permission boundaries, federation, break-glass
• Secure cloud networking — segmentation, SG/NSG rules, private endpoints, egress control
• Configure encryption — KMS/CMK policies, default encryption, TLS, secrets managers
• Enable audit and detective controls — CloudTrail/Audit Logs, Config, GuardDuty, CSPM
• Remediate misconfigurations from scans, audits, or Well-Architected security pillar
• Review workload designs for cloud threat patterns (IMDS, public buckets, open SGs)
• Integrate cloud findings into vulnerability and exception workflows
• Support incident forensics with cloud log analysis (with SOC/IR partners)

When NOT to Use

• Company security strategy, policies, board metrics → cybersecurity
• SSO/PAM/SIEM/EDR for corp-wide stack (non-cloud-specific) → information-security-engineer
• SAST/SCA/SBOM and GitHub Actions hardening → devsecops
• Live SOC alert triage and playbooks → soc-analyst
• Cloud telemetry threat hunts and ATT&CK campaigns → threat-hunter
• Authorized exploitation and pentest validation → penetration-tester
• Network/AD/infra pentest from corp paths → network-pentester
• Web/API OWASP testing → web-pentester
• GRC program, audit prep, vendor questionnaires → compliance-specialist
• SOC 2 control narratives and audit binders → compliance-engineer, cloud-compliance-specialist
• Build VPC/RDS without security as primary goal → cloud-engineer
• Landing zone business architecture and migration → cloud-architect
• Cloud program strategy and CCoE investment themes → vp-of-cloud
• Product multi-tenant isolation in app layer → product-infrastructure-security-engineer
• Cloud access tickets and patching → cloud-system-administrator
• Entitlement design, access reviews, federation, PAM → iam-specialist
• Customer security questionnaires, deal compliance fit (architecture) → solutions-architect

Related skills

| Need | Skill | |---|---| | VP cloud program and risk investment themes | vp-of-cloud | | Corporate security tooling and IdP | information-security-engineer | | Pipeline and supply-chain security | devsecops | | Cloud architecture and WAF reviews | cloud-architect | | Enterprise CCoE and regulated program | enterprise-cloud-architect | | Cloud resource implementation | cloud-engineer | | Terraform platform modules | infrastructure-engineer | | GRC program, gap plans, audit coordination | compliance-specialist | | Compliance evidence (org-wide) | compliance-engineer | | Cloud audit evidence and framework mapping | cloud-compliance-specialist | | SOC triage and playbooks | soc-analyst | | Active security IR, cloud log coordination | incident-responder | | Cloud telemetry threat hunts and hunt campaigns | threat-hunter | | Cloud alert investigation and detection tuning | defensive-security-analyst | | Pentest validation | penetration-tester | | Network/AD/infra pentest | network-pentester | | Web/API OWASP pentest | web-pentester | | Product tenancy | product-infrastructure-security-engineer | | Customer deal security/compliance fit memo | solutions-architect | | CVD and disclosure | technical-program-manager-security-cvd | | Cloud audit log forensics and super-timelines after preservation | digital-forensics-analyst | | Security risk registers and treatment prioritization | security-risk-analyst | | IAM lifecycle, access reviews, federation, PAM | iam-specialist |

Core Workflows

1. Scope and shared responsibility

Cloud security boundaries, provider vs customer duties.

See references/cloud_security_scope.md.

2. Cloud IAM and identity

Roles, federation, privilege escalation prevention.

See references/identity_iam_cloud.md.

3. Network security in cloud

Segmentation, private access, logging.

See references/network_cloud_security.md.

4. Data protection and KMS

Encryption, keys, secrets.

See references/data_encryption_kms.md.

5. Logging, CSPM, and detection

Audit logs, posture management, native detectors.

See references/detection_cspm_logging.md.

6. Architecture review and remediation

Threat patterns, review checklist, fix prioritization.

See references/secure_cloud_architecture_review.md.

Outputs

• Guardrail definition — SCP/policy JSON, exceptions, rollout plan
• IAM policy set — least-privilege roles with trust boundaries documented
• Network security diagram — zones, flows allowed/denied, private endpoints
• Remediation backlog — finding, severity, owner, compensating control
• Control evidence — Config rules, scan exports, sample audit log queries
• Architecture review notes — risks, required controls before launch

Principles

• Deny by default — explicit allow for network and IAM
• Security as code — guardrails versioned and reviewed like application code
• Detect and prove — every preventive control has a detective check
• Break-glass is rare and monitored — not a bypass for convenience
• Minimize blast radius — account segmentation and permission boundaries

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: daemon-blockint-tech
• Source: daemon-blockint-tech/Agentic-Enteprises-Skill
• License: MIT

Install and usage instructions live in the source repository linked above.