Cloud security engineer
Learn to lock down identities, networks and data on AWS, and to use AI tools and secure AI workloads while you do it, in 20 weeks.
Coming soon · planned, not written yet
- 20
- weeks planned
- ~40 h
- a week
- 5
- milestone projects
- 1
- project, grown every week
These are planned figures. The weeks are written after we check the tools against current job postings and official documentation, so the final route may differ.
Built for the AI era
How AI fits this roadmap
AI assistants now draft IAM policies, Terraform and detection queries in seconds, and they often get permissions too wide or miss a setting. That makes the cloud security engineer the person who reviews and tests what ships, so this roadmap has you use an AI assistant every week and check its output with policy analysis, scanners and a plan review. You also learn to secure AI workloads in the cloud: who can call a model, what an agent is allowed to do, and which prompt injection and data leak risks to test for.
The main project
Vaultline
A small web app with an AI assistant feature on AWS, which you harden step by step: identities, network, data, code checks, monitoring and an incident write-up.
What you will be able to do
- 01
Design least-privilege IAM roles and policies, and test each one, including policies an AI assistant drafted.
- 02
Build a multi-account AWS layout with guardrails, private networking and encrypted data, all defined in Terraform.
- 03
Scan Terraform in CI and write at least three custom policy-as-code rules that block unsafe changes.
- 04
Turn on AWS threat detection and posture checks, and triage findings into a ranked fix list with an AI-assisted summary you verify.
- 05
Threat-model and test an AI-backed feature for prompt injection, data leaks and excessive agent permissions, then write up one incident review.
01The route
Five months, one month at a time.
Each month ends in a milestone project, so you always have something to show for the work.
Month 1 · Weeks 1–4
Cloud and IAM foundations with AI-assisted work
AWS accounts, identity and access management, logging and the shared responsibility model. You set up an AI assistant, use it to draft policies, then test and tighten each one.
MilestoneVaultline running in a fresh AWS account with least-privilege roles, audit logging on, and a log of AI policy suggestions you accepted and rejected
Month 2 · Weeks 5–8
Network, data and infrastructure as code
Private networks, encryption, secrets and storage controls, all written in Terraform. You review every plan line by line and catch settings an AI assistant left too open.
MilestoneThe whole Vaultline setup created by Terraform, with private networking and encrypted data, reviewed by plan
Month 3 · Weeks 9–12
Guardrails and secure pipelines
Multi-account guardrails, Terraform scanning in CI with Checkov, and custom rules with Open Policy Agent. You use AI to draft rules, then prove each rule with passing and failing tests.
MilestoneA pipeline that blocks an unsafe Terraform change and shows why, with your own policy-as-code rules
Month 4 · Weeks 13–16
Detection, response and posture
AWS Security Hub, GuardDuty and IAM Access Analyzer findings, alert routing and automated fixes. You practise triage in a lab account, with AI summaries you check against the raw logs.
MilestonePosture and threat findings flowing to one place, with a ranked fix list and one automated remediation
Month 5 · Weeks 17–20
Securing AI workloads and capstone
Model access control, agent permissions, GuardDuty AI Protection for AI workloads, prompt injection and data leak tests using the OWASP Top 10 for LLM Applications as a checklist. Then an incident review, a portfolio write-up and interview preparation.
MilestoneA threat model and test report for Vaultline's AI feature, one incident review, and a portfolio ready to share
03What is inside
Everything a week comes with.
Every week is built the same way, so once you have done one you know how all of them work.
- 01
One project, Vaultline
You harden one app with an AI feature inside it, so every control lands in something real.
- 02
A day-by-day plan
Each week has a Learn part and a Do part, with a checklist so you know when you are done. Most weeks include a task to do with an AI assistant and a step to check its work.
- 03
A project in every milestone
Five milestones, each ending in something you can show and link to.
- 04
Reference topics
Short topic pages with check questions you can come back to.
- 05
A job track
Interview practice, portfolio and resume help, and an application plan.
- 06
Progress in your Study plan
Add weeks to your Study plan, give them dates, and finished days are counted for you.
04Is it for you
Who this is, and is not, for.
Better to know before you start than six weeks in.
It is for you if
- You know basic cloud ideas and some scripting, and want to move into cloud security.
- You are a developer, system administrator or DevOps engineer who wants to be strong at securing cloud and AI workloads.
- You can give about 40 hours a week for five months.
It is not for you if
- You have never used a terminal or a cloud account. Do a beginner course first.
- You want a job guarantee. Nobody can promise that, and this roadmap does not.
- You want to attack systems you do not own. All practice is in your own lab accounts or authorised targets, and it is legal.
- You want to paste AI output into production without reading it. This roadmap trains you to check it.
?Questions
Before you start
- Is this roadmap ready?
- Not yet. This is the plan. The weeks are being written and checked against current job postings and official documentation. Leave your email and we will write to you when it opens.
- What will it cost?
- The price is not set. Roadmaps are bought once, with no subscription. We will announce it when this one opens.
- Will the plan change?
- It may. Before the weeks are written we check the tools against current job postings, so the lengths and months here are planned, not final.
- Which cloud does it use, and will I need to pay?
- The plan uses AWS as the main cloud, because it is the clearest place to learn the ideas. The roadmap will show how to keep the bill small and how to shut labs down. Many AWS security services are paid after a free trial, so each week will say what costs money and when to turn it off.
- Will it get me a job?
- It will give you skills and proof of work. It cannot promise a job on a fixed date, because hiring depends on the market, your location and your past work.
Not open yet
Leave your email and we will write once, when it opens.