Full Transcript for The Cloud Security Engineer — $200K to Babysit the Robots (Special S05)

WEBVTT 00:00:03.020 --> 00:00:05.559 Machines now outnumber humans in the cloud by 00:00:05.559 --> 00:00:10.279 25 to 1 and in cloud native shops up to 144 to 00:00:10.279 --> 00:00:13.519 1. Somebody has to secure that army of robots 00:00:13.519 --> 00:00:16.300 that never sleeps and mostly has admin access. 00:00:17.000 --> 00:00:19.160 That somebody is the cloud security engineer, 00:00:19.379 --> 00:00:21.839 one of the fastest growing, best paid and quietly 00:00:21.839 --> 00:00:25.480 most brutal jobs in tech. Welcome to a tech updates 00:00:25.480 --> 00:00:29.239 special. Today, roll number five, the cloud security 00:00:29.239 --> 00:00:31.800 engineer. Forget the job title for a second. 00:00:32.030 --> 00:00:34.969 Here's what the work actually is. Four things 00:00:34.969 --> 00:00:38.929 all day. One, posture management. Continuously 00:00:38.929 --> 00:00:43.469 scanning AWS, Azure, and GCP for misconfigurations 00:00:43.469 --> 00:00:46.329 because misconfiguration causes more cloud breaches 00:00:46.329 --> 00:00:50.450 than any zero day. Two, identity. Designing least 00:00:50.450 --> 00:00:52.630 privilege access that's tight without breaking 00:00:52.630 --> 00:00:55.490 what the engineering teams need to ship. That 00:00:55.490 --> 00:00:58.469 is the single hardest part of the job. Three, 00:00:58.890 --> 00:01:01.450 securing the pipeline. Infrastructure as code 00:01:01.450 --> 00:01:04.030 scanning, container and Kubernetes security, 00:01:04.530 --> 00:01:07.489 secrets management, and four, building detection, 00:01:07.810 --> 00:01:11.069 turning a firehose of cloud API logs into alerts 00:01:11.069 --> 00:01:13.650 that actually mean something. One stat before 00:01:13.650 --> 00:01:17.049 we move on, the money and it's a wide band, so 00:01:17.049 --> 00:01:20.450 don't trust any single average. Entry lands around 00:01:20.450 --> 00:01:26.750 85 to $125 ,000, mid -career about 166, senior 00:01:26.750 --> 00:01:30.359 north of 200. And staff or principal at Big Tech 00:01:30.359 --> 00:01:33.700 with equity clears 300 ,000 and up. Here's the 00:01:33.700 --> 00:01:37.939 sharpest number. The AWS security specialty certification 00:01:37.939 --> 00:01:41.859 correlates with an average salary over $200 ,000. 00:01:42.239 --> 00:01:44.939 The single highest paying cloud cert in the field. 00:01:45.280 --> 00:01:48.019 The demand is real. It's the number two skills 00:01:48.019 --> 00:01:51.959 gap on earth behind only AI security. Now the 00:01:51.959 --> 00:01:54.780 catch nobody warns you about. This is not a job 00:01:54.780 --> 00:01:57.569 full of glamorous zero days. Gartner's line is 00:01:57.569 --> 00:02:01.450 brutal and basically true. 99 % of cloud security 00:02:01.450 --> 00:02:04.349 failures are the customer's fault. The average 00:02:04.349 --> 00:02:07.329 enterprise is running over 3 ,000 misconfigured 00:02:07.329 --> 00:02:10.169 cloud assets at any given moment. And the breach 00:02:10.169 --> 00:02:12.930 that defines the modern job, the sales loft drift 00:02:12.930 --> 00:02:16.830 attack, didn't crack any encryption. Attackers 00:02:16.830 --> 00:02:20.270 stole OAuth tokens that bypassed MFA entirely 00:02:20.270 --> 00:02:24.050 and pivoted into over 700 organizations. This 00:02:24.050 --> 00:02:26.949 is a non -human identity job now. whether the 00:02:26.949 --> 00:02:30.330 title says so or not. So what's a real day? 8 00:02:30.330 --> 00:02:33.949 a .m. The posture queue. Last night's scan flagged 00:02:33.949 --> 00:02:38.289 40 new misconfigurations. 10 a .m. An IAM review. 00:02:38.750 --> 00:02:41.090 An over -permissioned role that engineering swears 00:02:41.090 --> 00:02:44.370 it needs. 1 p .m. You block a terraform pull 00:02:44.370 --> 00:02:46.409 request that would have opened a storage bucket 00:02:46.409 --> 00:02:49.780 to the internet. 3 p .m. You're hunting a token 00:02:49.780 --> 00:02:52.460 nobody rotated, tied to a service nobody owns. 00:02:53.020 --> 00:02:55.879 5pm, you're on call. Because the queue does not 00:02:55.879 --> 00:02:59.000 actually end, it just resets. If you love the 00:02:59.000 --> 00:03:01.680 feeling of a clean dashboard, this job will hurt. 00:03:02.180 --> 00:03:04.520 If you love the hunt, you'll never be bored. 00:03:04.960 --> 00:03:08.379 How do you get in? Two common paths. System administrator 00:03:08.379 --> 00:03:11.400 or cloud engineer moving into security, or a 00:03:11.400 --> 00:03:14.240 SOC analyst moving up into the cloud. The cert 00:03:14.240 --> 00:03:17.020 ladder that actually gets hired. the floor is 00:03:17.020 --> 00:03:20.159 security plus plus a cloud fundamental cert the 00:03:20.159 --> 00:03:24.319 jump maker is the aws security specialty or azure's 00:03:24.319 --> 00:03:29.099 az 500 the senior gold standard is the ccsp once 00:03:29.099 --> 00:03:31.759 you have real cloud time behind you but here's 00:03:31.759 --> 00:03:35.080 the truth the cert gets you the interview what 00:03:35.080 --> 00:03:37.860 gets you the job is surviving a live identity 00:03:37.860 --> 00:03:40.919 scoping exercise on a whiteboard let's translate 00:03:40.919 --> 00:03:44.819 the hype linkedin says cloud security gold rush 00:03:45.099 --> 00:03:48.060 Highest paying certs, fastest growing domain. 00:03:48.599 --> 00:03:52.120 The actual day says YAML, identity policy hell, 00:03:52.620 --> 00:03:55.360 and an endless queue of 3 ,000 misconfigurations 00:03:55.360 --> 00:03:58.599 that regenerate faster than you close them. LinkedIn 00:03:58.599 --> 00:04:01.819 says, they're desperate to hire you. Reality 00:04:01.819 --> 00:04:05.319 says, budget just became the number one hiring 00:04:05.319 --> 00:04:08.259 blocker. So the demand is real, but the wrecks 00:04:08.259 --> 00:04:11.599 are throttled. The role is genuinely great. It 00:04:11.599 --> 00:04:15.370 is also genuinely a grind. Both are true. So, 00:04:15.530 --> 00:04:18.790 here's the close. Misconfigurations aren't glamorous. 00:04:19.149 --> 00:04:21.629 They are the job, and they're also where almost 00:04:21.629 --> 00:04:24.209 every cloud breach actually comes from, which 00:04:24.209 --> 00:04:26.629 makes the person who tames identity and posture 00:04:26.629 --> 00:04:30.329 at scale quietly indispensable. In three to five 00:04:30.329 --> 00:04:32.829 years, this leads to cloud security architect, 00:04:33.310 --> 00:04:36.050 and from there, the CISO track. Real demand, 00:04:36.350 --> 00:04:39.290 real money, real grind. Just go in knowing it's 00:04:39.290 --> 00:04:42.110 the console, not the LinkedIn post. That's the 00:04:42.110 --> 00:04:44.529 special. Next week we go back to a fan favorite 00:04:44.529 --> 00:04:47.470 and update it, Machine Identity, one year later. 00:04:47.970 --> 00:04:50.069 Remember Dave and his service account? He's back. 00:04:50.430 --> 00:04:52.410 This is Tech Updates. Stay sharp.