WEBVTT
00:00:03.020 --> 00:00:05.559
Machines now outnumber humans in the cloud by
00:00:05.559 --> 00:00:10.279
25 to 1 and in cloud native shops up to 144 to
00:00:10.279 --> 00:00:13.519
1. Somebody has to secure that army of robots
00:00:13.519 --> 00:00:16.300
that never sleeps and mostly has admin access.
00:00:17.000 --> 00:00:19.160
That somebody is the cloud security engineer,
00:00:19.379 --> 00:00:21.839
one of the fastest growing, best paid and quietly
00:00:21.839 --> 00:00:25.480
most brutal jobs in tech. Welcome to a tech updates
00:00:25.480 --> 00:00:29.239
special. Today, roll number five, the cloud security
00:00:29.239 --> 00:00:31.800
engineer. Forget the job title for a second.
00:00:32.030 --> 00:00:34.969
Here's what the work actually is. Four things
00:00:34.969 --> 00:00:38.929
all day. One, posture management. Continuously
00:00:38.929 --> 00:00:43.469
scanning AWS, Azure, and GCP for misconfigurations
00:00:43.469 --> 00:00:46.329
because misconfiguration causes more cloud breaches
00:00:46.329 --> 00:00:50.450
than any zero day. Two, identity. Designing least
00:00:50.450 --> 00:00:52.630
privilege access that's tight without breaking
00:00:52.630 --> 00:00:55.490
what the engineering teams need to ship. That
00:00:55.490 --> 00:00:58.469
is the single hardest part of the job. Three,
00:00:58.890 --> 00:01:01.450
securing the pipeline. Infrastructure as code
00:01:01.450 --> 00:01:04.030
scanning, container and Kubernetes security,
00:01:04.530 --> 00:01:07.489
secrets management, and four, building detection,
00:01:07.810 --> 00:01:11.069
turning a firehose of cloud API logs into alerts
00:01:11.069 --> 00:01:13.650
that actually mean something. One stat before
00:01:13.650 --> 00:01:17.049
we move on, the money and it's a wide band, so
00:01:17.049 --> 00:01:20.450
don't trust any single average. Entry lands around
00:01:20.450 --> 00:01:26.750
85 to $125 ,000, mid -career about 166, senior
00:01:26.750 --> 00:01:30.359
north of 200. And staff or principal at Big Tech
00:01:30.359 --> 00:01:33.700
with equity clears 300 ,000 and up. Here's the
00:01:33.700 --> 00:01:37.939
sharpest number. The AWS security specialty certification
00:01:37.939 --> 00:01:41.859
correlates with an average salary over $200 ,000.
00:01:42.239 --> 00:01:44.939
The single highest paying cloud cert in the field.
00:01:45.280 --> 00:01:48.019
The demand is real. It's the number two skills
00:01:48.019 --> 00:01:51.959
gap on earth behind only AI security. Now the
00:01:51.959 --> 00:01:54.780
catch nobody warns you about. This is not a job
00:01:54.780 --> 00:01:57.569
full of glamorous zero days. Gartner's line is
00:01:57.569 --> 00:02:01.450
brutal and basically true. 99 % of cloud security
00:02:01.450 --> 00:02:04.349
failures are the customer's fault. The average
00:02:04.349 --> 00:02:07.329
enterprise is running over 3 ,000 misconfigured
00:02:07.329 --> 00:02:10.169
cloud assets at any given moment. And the breach
00:02:10.169 --> 00:02:12.930
that defines the modern job, the sales loft drift
00:02:12.930 --> 00:02:16.830
attack, didn't crack any encryption. Attackers
00:02:16.830 --> 00:02:20.270
stole OAuth tokens that bypassed MFA entirely
00:02:20.270 --> 00:02:24.050
and pivoted into over 700 organizations. This
00:02:24.050 --> 00:02:26.949
is a non -human identity job now. whether the
00:02:26.949 --> 00:02:30.330
title says so or not. So what's a real day? 8
00:02:30.330 --> 00:02:33.949
a .m. The posture queue. Last night's scan flagged
00:02:33.949 --> 00:02:38.289
40 new misconfigurations. 10 a .m. An IAM review.
00:02:38.750 --> 00:02:41.090
An over -permissioned role that engineering swears
00:02:41.090 --> 00:02:44.370
it needs. 1 p .m. You block a terraform pull
00:02:44.370 --> 00:02:46.409
request that would have opened a storage bucket
00:02:46.409 --> 00:02:49.780
to the internet. 3 p .m. You're hunting a token
00:02:49.780 --> 00:02:52.460
nobody rotated, tied to a service nobody owns.
00:02:53.020 --> 00:02:55.879
5pm, you're on call. Because the queue does not
00:02:55.879 --> 00:02:59.000
actually end, it just resets. If you love the
00:02:59.000 --> 00:03:01.680
feeling of a clean dashboard, this job will hurt.
00:03:02.180 --> 00:03:04.520
If you love the hunt, you'll never be bored.
00:03:04.960 --> 00:03:08.379
How do you get in? Two common paths. System administrator
00:03:08.379 --> 00:03:11.400
or cloud engineer moving into security, or a
00:03:11.400 --> 00:03:14.240
SOC analyst moving up into the cloud. The cert
00:03:14.240 --> 00:03:17.020
ladder that actually gets hired. the floor is
00:03:17.020 --> 00:03:20.159
security plus plus a cloud fundamental cert the
00:03:20.159 --> 00:03:24.319
jump maker is the aws security specialty or azure's
00:03:24.319 --> 00:03:29.099
az 500 the senior gold standard is the ccsp once
00:03:29.099 --> 00:03:31.759
you have real cloud time behind you but here's
00:03:31.759 --> 00:03:35.080
the truth the cert gets you the interview what
00:03:35.080 --> 00:03:37.860
gets you the job is surviving a live identity
00:03:37.860 --> 00:03:40.919
scoping exercise on a whiteboard let's translate
00:03:40.919 --> 00:03:44.819
the hype linkedin says cloud security gold rush
00:03:45.099 --> 00:03:48.060
Highest paying certs, fastest growing domain.
00:03:48.599 --> 00:03:52.120
The actual day says YAML, identity policy hell,
00:03:52.620 --> 00:03:55.360
and an endless queue of 3 ,000 misconfigurations
00:03:55.360 --> 00:03:58.599
that regenerate faster than you close them. LinkedIn
00:03:58.599 --> 00:04:01.819
says, they're desperate to hire you. Reality
00:04:01.819 --> 00:04:05.319
says, budget just became the number one hiring
00:04:05.319 --> 00:04:08.259
blocker. So the demand is real, but the wrecks
00:04:08.259 --> 00:04:11.599
are throttled. The role is genuinely great. It
00:04:11.599 --> 00:04:15.370
is also genuinely a grind. Both are true. So,
00:04:15.530 --> 00:04:18.790
here's the close. Misconfigurations aren't glamorous.
00:04:19.149 --> 00:04:21.629
They are the job, and they're also where almost
00:04:21.629 --> 00:04:24.209
every cloud breach actually comes from, which
00:04:24.209 --> 00:04:26.629
makes the person who tames identity and posture
00:04:26.629 --> 00:04:30.329
at scale quietly indispensable. In three to five
00:04:30.329 --> 00:04:32.829
years, this leads to cloud security architect,
00:04:33.310 --> 00:04:36.050
and from there, the CISO track. Real demand,
00:04:36.350 --> 00:04:39.290
real money, real grind. Just go in knowing it's
00:04:39.290 --> 00:04:42.110
the console, not the LinkedIn post. That's the
00:04:42.110 --> 00:04:44.529
special. Next week we go back to a fan favorite
00:04:44.529 --> 00:04:47.470
and update it, Machine Identity, one year later.
00:04:47.970 --> 00:04:50.069
Remember Dave and his service account? He's back.
00:04:50.430 --> 00:04:52.410
This is Tech Updates. Stay sharp.
00:00:03.020 --> 00:00:05.559
Machines now outnumber humans in the cloud by
00:00:05.559 --> 00:00:10.279
25 to 1 and in cloud native shops up to 144 to
00:00:10.279 --> 00:00:13.519
1. Somebody has to secure that army of robots
00:00:13.519 --> 00:00:16.300
that never sleeps and mostly has admin access.
00:00:17.000 --> 00:00:19.160
That somebody is the cloud security engineer,
00:00:19.379 --> 00:00:21.839
one of the fastest growing, best paid and quietly
00:00:21.839 --> 00:00:25.480
most brutal jobs in tech. Welcome to a tech updates
00:00:25.480 --> 00:00:29.239
special. Today, roll number five, the cloud security
00:00:29.239 --> 00:00:31.800
engineer. Forget the job title for a second.
00:00:32.030 --> 00:00:34.969
Here's what the work actually is. Four things
00:00:34.969 --> 00:00:38.929
all day. One, posture management. Continuously
00:00:38.929 --> 00:00:43.469
scanning AWS, Azure, and GCP for misconfigurations
00:00:43.469 --> 00:00:46.329
because misconfiguration causes more cloud breaches
00:00:46.329 --> 00:00:50.450
than any zero day. Two, identity. Designing least
00:00:50.450 --> 00:00:52.630
privilege access that's tight without breaking
00:00:52.630 --> 00:00:55.490
what the engineering teams need to ship. That
00:00:55.490 --> 00:00:58.469
is the single hardest part of the job. Three,
00:00:58.890 --> 00:01:01.450
securing the pipeline. Infrastructure as code
00:01:01.450 --> 00:01:04.030
scanning, container and Kubernetes security,
00:01:04.530 --> 00:01:07.489
secrets management, and four, building detection,
00:01:07.810 --> 00:01:11.069
turning a firehose of cloud API logs into alerts
00:01:11.069 --> 00:01:13.650
that actually mean something. One stat before
00:01:13.650 --> 00:01:17.049
we move on, the money and it's a wide band, so
00:01:17.049 --> 00:01:20.450
don't trust any single average. Entry lands around
00:01:20.450 --> 00:01:26.750
85 to $125 ,000, mid -career about 166, senior
00:01:26.750 --> 00:01:30.359
north of 200. And staff or principal at Big Tech
00:01:30.359 --> 00:01:33.700
with equity clears 300 ,000 and up. Here's the
00:01:33.700 --> 00:01:37.939
sharpest number. The AWS security specialty certification
00:01:37.939 --> 00:01:41.859
correlates with an average salary over $200 ,000.
00:01:42.239 --> 00:01:44.939
The single highest paying cloud cert in the field.
00:01:45.280 --> 00:01:48.019
The demand is real. It's the number two skills
00:01:48.019 --> 00:01:51.959
gap on earth behind only AI security. Now the
00:01:51.959 --> 00:01:54.780
catch nobody warns you about. This is not a job
00:01:54.780 --> 00:01:57.569
full of glamorous zero days. Gartner's line is
00:01:57.569 --> 00:02:01.450
brutal and basically true. 99 % of cloud security
00:02:01.450 --> 00:02:04.349
failures are the customer's fault. The average
00:02:04.349 --> 00:02:07.329
enterprise is running over 3 ,000 misconfigured
00:02:07.329 --> 00:02:10.169
cloud assets at any given moment. And the breach
00:02:10.169 --> 00:02:12.930
that defines the modern job, the sales loft drift
00:02:12.930 --> 00:02:16.830
attack, didn't crack any encryption. Attackers
00:02:16.830 --> 00:02:20.270
stole OAuth tokens that bypassed MFA entirely
00:02:20.270 --> 00:02:24.050
and pivoted into over 700 organizations. This
00:02:24.050 --> 00:02:26.949
is a non -human identity job now. whether the
00:02:26.949 --> 00:02:30.330
title says so or not. So what's a real day? 8
00:02:30.330 --> 00:02:33.949
a .m. The posture queue. Last night's scan flagged
00:02:33.949 --> 00:02:38.289
40 new misconfigurations. 10 a .m. An IAM review.
00:02:38.750 --> 00:02:41.090
An over -permissioned role that engineering swears
00:02:41.090 --> 00:02:44.370
it needs. 1 p .m. You block a terraform pull
00:02:44.370 --> 00:02:46.409
request that would have opened a storage bucket
00:02:46.409 --> 00:02:49.780
to the internet. 3 p .m. You're hunting a token
00:02:49.780 --> 00:02:52.460
nobody rotated, tied to a service nobody owns.
00:02:53.020 --> 00:02:55.879
5pm, you're on call. Because the queue does not
00:02:55.879 --> 00:02:59.000
actually end, it just resets. If you love the
00:02:59.000 --> 00:03:01.680
feeling of a clean dashboard, this job will hurt.
00:03:02.180 --> 00:03:04.520
If you love the hunt, you'll never be bored.
00:03:04.960 --> 00:03:08.379
How do you get in? Two common paths. System administrator
00:03:08.379 --> 00:03:11.400
or cloud engineer moving into security, or a
00:03:11.400 --> 00:03:14.240
SOC analyst moving up into the cloud. The cert
00:03:14.240 --> 00:03:17.020
ladder that actually gets hired. the floor is
00:03:17.020 --> 00:03:20.159
security plus plus a cloud fundamental cert the
00:03:20.159 --> 00:03:24.319
jump maker is the aws security specialty or azure's
00:03:24.319 --> 00:03:29.099
az 500 the senior gold standard is the ccsp once
00:03:29.099 --> 00:03:31.759
you have real cloud time behind you but here's
00:03:31.759 --> 00:03:35.080
the truth the cert gets you the interview what
00:03:35.080 --> 00:03:37.860
gets you the job is surviving a live identity
00:03:37.860 --> 00:03:40.919
scoping exercise on a whiteboard let's translate
00:03:40.919 --> 00:03:44.819
the hype linkedin says cloud security gold rush
00:03:45.099 --> 00:03:48.060
Highest paying certs, fastest growing domain.
00:03:48.599 --> 00:03:52.120
The actual day says YAML, identity policy hell,
00:03:52.620 --> 00:03:55.360
and an endless queue of 3 ,000 misconfigurations
00:03:55.360 --> 00:03:58.599
that regenerate faster than you close them. LinkedIn
00:03:58.599 --> 00:04:01.819
says, they're desperate to hire you. Reality
00:04:01.819 --> 00:04:05.319
says, budget just became the number one hiring
00:04:05.319 --> 00:04:08.259
blocker. So the demand is real, but the wrecks
00:04:08.259 --> 00:04:11.599
are throttled. The role is genuinely great. It
00:04:11.599 --> 00:04:15.370
is also genuinely a grind. Both are true. So,
00:04:15.530 --> 00:04:18.790
here's the close. Misconfigurations aren't glamorous.
00:04:19.149 --> 00:04:21.629
They are the job, and they're also where almost
00:04:21.629 --> 00:04:24.209
every cloud breach actually comes from, which
00:04:24.209 --> 00:04:26.629
makes the person who tames identity and posture
00:04:26.629 --> 00:04:30.329
at scale quietly indispensable. In three to five
00:04:30.329 --> 00:04:32.829
years, this leads to cloud security architect,
00:04:33.310 --> 00:04:36.050
and from there, the CISO track. Real demand,
00:04:36.350 --> 00:04:39.290
real money, real grind. Just go in knowing it's
00:04:39.290 --> 00:04:42.110
the console, not the LinkedIn post. That's the
00:04:42.110 --> 00:04:44.529
special. Next week we go back to a fan favorite
00:04:44.529 --> 00:04:47.470
and update it, Machine Identity, one year later.
00:04:47.970 --> 00:04:50.069
Remember Dave and his service account? He's back.
00:04:50.430 --> 00:04:52.410
This is Tech Updates. Stay sharp.
