Cloud Security: market

Vacancy

an open job that cleared the quality gate and lists at least two technologies

Observed candidate

a candidate whose stack contains this technology; an aggregate — not a single record leaves the perimeter

Matchable candidate

not counted yet

Window

jobs open at the moment the snapshot was built

Junior — typical entry: 1) Cloud Engineer Middle + interest in security (cloud expertise already there, need security techniques), 2) Security Engineer Middle + interest in cloud-specific deep, 3) DevSecOps Middle + cloud focus. Junior → Middle jump — after the first CSPM tool deployment (Wiz / Prisma Cloud / native AWS Security Hub) + first multi-account IAM remediation initiative. Middle → Senior — multi-cloud governance + landing zone security architecture + CNAPP tooling mastery + compliance frameworks automation (FedRAMP / SOC 2 / ISO 27001 cloud-specific evidence). Senior → Cloud Security Architect — org-wide cloud security strategy + multi-cloud Zero Trust + executive advisory. Career flow: Cloud Engineer Senior (3-5 years) + interest → Cloud Security Engineer Junior (1-2 years) → Middle (2-3 years) → Senior → either Cloud Security Architect, CNAPP/CSPM tooling specialist (Wiz CSE / Prisma Cloud expert), CISO Cloud track, or pivot into a native cloud-provider security team (AWS / GCP / Azure — premium tier).

Top 5: cloud, aws, azure, ci/cd, gcp. One cloud platform deeply + basics of the other two. AWS Security mastery: GuardDuty + Security Hub + Macie + Inspector + Detective + Config + IAM Access Analyzer + KMS + Secrets Manager + WAF + Shield + Network Firewall + VPC Flow Logs + Security Lake (2024+ — security data lake). AWS Security Specialty (SCS-C02) cert. GCP Security mastery: Security Command Center (SCC Enterprise — flagship) + Cloud Armor (WAF + DDoS) + Cloud DLP + Cloud KMS + Secret Manager + Cloud Identity + Web Risk + Chronicle (Google's SIEM — premium). GCP Professional Cloud Security Engineer cert. Azure SC-100 (Cybersecurity Architect Expert) + AZ-500 (Security Engineer Associate). CSPM mastery: Wiz (leader 2026 — premium pricing, agentless architecture — must-know for frontier cloud-security roles) + Prisma Cloud (Palo Alto enterprise) + Lacework + Orca Security (agentless Wiz competitor) + Sysdig Secure + Aqua Cloud Security + Check Point CloudGuard + Tenable Cloud Security (Ermetic — CIEM-strong) + Datadog Cloud Security Management + Zscaler Posture Control. Open-source: Prowler (AWS leader — must for AWS shops) + Cloud Custodian (multi-cloud policy engine) + ScoutSuite + CloudSploit + Steampipe (SQL queries cloud resources). CIEM: Wiz CIEM + Tenable Cloud Security (Ermetic — CIEM leader) + SailPoint + Saviynt + CyberArk Secure Cloud Access. Pacu (offensive AWS exploitation). CNAPP: Wiz (defined the category) + Prisma Cloud + CrowdStrike Falcon Cloud Security + Lacework + Orca + Sysdig + SentinelOne Cloud Security + Aqua CNAPP. DSPM rising 2024+: BigID (leader) + Cyera + Symmetry Systems + Sentra + Securiti. Container / K8s security: Falco runtime + Cilium Tetragon + Tracee + Trivy/Grype/Snyk Container image scanning + OPA Gatekeeper / Kyverno admission controllers + Sigstore cosign image signing + Kubescape (CNCF K8s posture) + kube-bench (CIS) + kube-hunter (pentesting). Serverless security: Snyk Function Scanning + Lambda least-privilege + dependency security. IaC scanning: Checkov (best for Terraform/CFN) + tfsec + KICS + Terrascan + Snyk IaC. Cloud secrets: HashiCorp Vault (industry standard) + cloud-native (Secrets Manager/Parameter Store + Secret Manager + Key Vault) + Doppler/Akeyless/1Password Secrets Automation + External Secrets Operator for K8s. Cloud encryption: KMS envelope encryption + HSM (CloudHSM/Cloud HSM/Dedicated HSM) + BYOK/HYOK. Compliance frameworks: SOC 2 + ISO 27001 + PCI-DSS + HIPAA + FedRAMP + GDPR + 152-FZ + 187-FZ + CIS AWS/Azure/GCP Benchmarks. Languages: Python primary + Terraform IaC security + bash + PowerShell + Go bonus.

Cloud Engineer — focus on cloud infrastructure provisioning + cost optimisation + multi-account governance. Not security-specific. See Cloud Engineer. DevSecOps Engineer — focus on security in CI/CD pipelines + IaC security + container runtime + supply chain. Infrastructure-side. See DevSecOps. Security Engineer (general) — broad coverage of all security domains. See Security Engineer (general). Cloud Security Engineer (this page) — focus on cloud-specific security: AWS/GCP/Azure native services + CSPM/CIEM/CNAPP + cloud compliance + cloud-specific IAM mastery + multi-account governance + cloud encryption. Sweet spot premium segment due to hybrid skills. Reality 2026 (overlap heatmap): Cloud Security ↔ Cloud Engineer: 60% (both deep in one cloud but focus differs). Cloud Security ↔ DevSecOps: 50% (overlap in container security + IaC + supply chain). Cloud Security ↔ Security Engineer general: 40% (Cloud Security deep in cloud domain, Security Engineer breadth). Career pivots: Cloud Engineer Senior → Cloud Security Junior — 4-8 months (need to add security techniques + CSPM tools + IAM mastery + compliance frameworks). Security Engineer Middle → Cloud Security — 4-8 months (need cloud depth). DevSecOps Senior → Cloud Security — 2-4 months (much overlap). Reality 2026: the Cloud Security market grows faster than security overall thanks to continued cloud adoption (89% of companies use 2+ clouds per Flexera) + multi-cloud governance pain + regulatory pressure (FedRAMP / SOC 2 / CIS Benchmarks).

Use case: enterprises with budget + multi-cloud + want best-in-class. Won the most recent Gartner MQ 2024. 2) Prisma Cloud (Palo Alto Networks) — enterprise comprehensive — Twistlock + RedLock + PureSec acquisitions consolidated. Strengths: deep container/K8s security (Twistlock heritage), broad coverage. Weaknesses: heavier deployment, complex pricing. Use case: existing Palo Alto Networks customer + want a unified platform. 3) Lacework — behaviour-based detection (Polygraph data platform) + multi-cloud. Strengths: anomaly detection without custom rules. Weaknesses: less mature UI than Wiz. Use case: mid-market + want behaviour-driven detection. 4) Orca Security — agentless competitor to Wiz (similar architecture — uses cloud APIs). Strengths: patented side-scanning technology — no agents, less performance impact. Cheaper than Wiz typically. Use case: similar to Wiz but budget-constrained. 5) Sysdig Secure — runtime-focused (eBPF-based) + container-strong. Strengths: deep runtime security (Falco heritage — Sysdig invented Falco), best for container-heavy workloads. Weaknesses: less broad CSPM coverage. Use case: Kubernetes-heavy + want runtime security depth. 6) Aqua Cloud Security — container-first vendor (Trivy creators) + CNAPP. Strengths: container security depth + open-source heritage (Trivy widely used). Use case: container-mature shops + want a vendor stewarding open-source. 7) CrowdStrike Falcon Cloud Security — extension from EDR leader CrowdStrike. Strengths: integrated with EDR + Falcon platform. Use case: existing CrowdStrike customer wanting cloud security extension. 8) Snyk Cloud — extension from SCA/SAST leader Snyk. Strengths: developer-friendly + IDE integration. Use case: existing Snyk customer wanting cloud security. 9) Cloud-native (free / cheap): AWS Security Hub + GuardDuty + Macie + IAM Access Analyzer + Config / GCP Security Command Center / Azure Defender for Cloud + Sentinel. Use case: budget-constrained + ok with vendor lock + small cloud footprint. 10) Open-source CSPM: Prowler (AWS — leader, used by Wiz themselves for AWS scanning), Cloud Custodian (multi-cloud policy engine), ScoutSuite, CloudSploit, Steampipe (SQL queries for cloud resources). Use case: zero budget + technical team able to operate it. Default 2026 recommendations: Enterprise + multi-cloud + budget ok → Wiz or Prisma Cloud. Container-heavy → Sysdig Secure or Aqua. Existing CrowdStrike/Snyk customer → Falcon Cloud Security / Snyk Cloud extension. Budget-constrained → cloud-native + Prowler / Cloud Custodian open-source. Best UX agentless → Wiz or Orca. Russian market (post-AWS/GCP departure) → cloud-provider-native + Russian security vendors.

Yes, 24% of Cloud Security Engineer jobs are full-remote or hybrid. Cloud Security work is fully cloud-based (entirely via consoles + dashboards + SaaS tools). Outsourcing shops (EPAM Cloud Security Practice / Luxoft / Andersen / DataArt Cloud Security) — almost always remote on US projects. Russian banks — hybrid/office due to regulatory + cloud-data sovereignty mandate. Russian cloud providers — hybrid or remote after security background check. Russian security vendors — hybrid. State companies — hybrid/office mandatory due to air-gapped + clearances. CSPM/CNAPP vendor companies (Wiz / Prisma Cloud / Lacework / Orca / Sysdig / Aqua / Snyk Cloud) — full-remote standard, premium segment for Russian-speaking Seniors with English. Cloud-native security — full-remote. Big Tech Cloud Security (AWS Security team / GCP Security / Azure Security / Apple Cloud / Meta Production Engineering Security) — hybrid-standard. Relocant hubs: Poland (Cloud Security-friendly EU) / Germany (Berlin + Munich) / Canada / Serbia / UAE. English for international Cloud Security remote — must (vendor docs Wiz / Prisma / Snyk + community + conferences fwd:cloudsec / RSA / Black Hat — English-speaking).

Senior Cloud Security Engineer — hands-on owner of cloud security implementations. Day-to-day: tune CSPM tool policies (Wiz / Prisma Cloud rules), respond to security findings, IAM remediation, vulnerability triage, automation (Python for cloud security scripts), compliance evidence collection. Programming-moderate. Cloud Security Architect — designs org-wide cloud security strategy + multi-cloud Zero Trust architecture + landing zone security patterns + compliance framework selection. Day-to-day: ADRs writing for cloud security decisions, design reviews for product team cloud security proposals, multi-cloud governance strategy, executive advisory to CISO / CTO, vendor evaluations (Wiz vs Prisma vs Orca decision), budget defence. Programming less. Career path: Senior Cloud Security Engineer (4-6 years) → Cloud Security Architect → Principal Cloud Security Architect / Distinguished / CISO Cloud track. CSPM/CNAPP Engineer specialist (sub-specialty) — deep expertise in one CSPM tool deeply (Wiz CSE — Certified Security Engineer / Prisma Cloud Certified Engineer / Lacework). Often works at vendor companies or premium consultancies (PwC Cloud Security / Deloitte Cloud Security). Pay comparable with Senior Cloud Security + premium on vendor cert. AWS / GCP / Azure Security Engineer (cloud-specific specialist) — deep expertise in one cloud's security services natively (not generalised cloud security). Often inside a cloud-provider team (AWS Security / GCP Security / Azure Security) or at companies with single-cloud heavy. Career choice: Senior Engineer if hands-on is interesting, Architect if strategy + cross-team, CSPM specialist if tooling depth, single-cloud specialist if you want premium tier in a native cloud-provider team.

Roadmap: 1) Cloud fundamentals solid — pick one cloud deeply (AWS / GCP / Azure) and pass the Foundation cert (AWS Cloud Practitioner / GCP Cloud Digital Leader / Azure Fundamentals AZ-900). 2) Cloud Engineer base — Associate-level cert (AWS SA Associate / GCP Associate Cloud Engineer / Azure AZ-104). IAM mastery + VPC design + cloud-native services overview. 3) Security fundamentals — OWASP Top 10 + CIA Triad + cryptography basics + network protocols (TCP / TLS / VPN). 4) Security+ cert (CompTIA — foundation). 5) Cloud Security-specific cert: AWS Security Specialty (SCS-C02) — must for the AWS Security track (premium cert + recognised industry-wide). Or Azure SC-100 (Cybersecurity Architect Expert) + AZ-500 (Security Engineer). Or GCP Professional Cloud Security Engineer. 6) IaC mastery: Terraform + cloud-native IaC (AWS CDK / Azure Bicep). Hands-on with Checkov / tfsec for IaC security scanning. 7) Open-source CSPM hands-on: Prowler (AWS — must) + Cloud Custodian + ScoutSuite. Run on your own AWS Free Tier account. Understand misconfiguration patterns. 8) Container security: Falco runtime + Trivy image scanning + OPA Gatekeeper or Kyverno admission. Set up on your own K8s cluster (kind / k3s). 9) HashiCorp Vault deep: industry standard for secrets management. Set up self-hosted Vault + integration with K8s (External Secrets Operator). 10) Cloud-native SIEM hands-on: AWS Security Lake setup or GCP Chronicle or Azure Sentinel. Build basic detection rules. 11) CSPM/CNAPP vendor tools (if budget or employer-provided): try Wiz / Prisma Cloud / Snyk Cloud trial / Lacework demos. Understand reporting outputs. 12) Compliance frameworks deep: CIS AWS Benchmarks / CIS Azure / CIS GCP — automate compliance checks (Prowler already implements CIS). FedRAMP / SOC 2 / ISO 27001 cloud-specific requirements. 13) Premium certs path: CCSP (Certified Cloud Security Professional — ISC²) or CCSK (Certificate of Cloud Security Knowledge — Cloud Security Alliance) — premium Cloud Security certs. Multi-cloud trio: AWS Security Specialty + Azure SC-100 + GCP Professional Cloud Security — premium-tier resume signal. 14) Pet project portfolio: a) full Cloud Security architecture for AWS account (multi-account governance + Control Tower + Security Hub + GuardDuty + custom Prowler rules); b) Wiz / Prisma Cloud demo deployment (use trial); c) K8s security setup (Falco + Kyverno policies + Sigstore signing). Document on GitHub + blog post. International (EN): SANS courses (SEC540 Cloud Security & DevOps Automation — premium expensive but best), "Practical DevSecOps" courses, A Cloud Guru / Cloud Academy Security tracks, AWS Skill Builder Security learning paths. Must-read books: "Cloud Native Security" Liz Rice, "Container Security" Liz Rice, "Practical Cloud Security" Chris Dotson, "AWS Security Cookbook" Heartin Kanikathottu. Cloud Engineer Middle + interest → Cloud Security Junior — 4-8 months.

63 active open Cloud Security Engineer positions — growing segment due to mainstream cloud adoption + multi-cloud reality + regulatory pressure (FedRAMP / SOC 2 / CIS Benchmarks). Geography: Russia / Poland / remote. The real market is broader thanks to the international remote segment (CSPM/CNAPP vendors — full-remote-friendly) + Big Tech Cloud Security teams (AWS Security largest + GCP Security + Azure Security teams). Time to close a Senior Cloud Security Engineer — 6-12 weeks (longer than general DevOps due to rare-skill combination — cloud expertise + security expertise + multi-cloud certifications).

A Senior Cloud Security Engineer owns the full cloud security cycle + multi-cloud governance + technical leadership. One cloud Pro-level Security cert: AWS Security Specialty (SCS-C02) or Azure SC-100 / AZ-500 or GCP Professional Cloud Security Engineer — at real production scale. Multi-cloud basics: knowledge of the other two clouds at Associate level minimum. IAM mastery deep: multi-account least-privilege design + automation (AWS Organizations SCPs + GCP Organization Policy + Azure Management Groups), service-to-service IAM patterns (IRSA for EKS / Workload Identity for GKE / Managed Identity for Azure), privileged access management (PAM tools — CyberArk / BeyondTrust / HashiCorp Boundary), JIT (Just-In-Time) access patterns. CSPM tooling mastery: one of Wiz / Prisma Cloud / Lacework / Orca / Sysdig deeply — custom policy authoring, finding triage workflows, remediation automation, multi-account onboarding strategy. Native cloud security services mastery: AWS Security Hub + GuardDuty + Macie + Inspector + Config + IAM Access Analyzer advanced (custom detectors, automated remediation) or GCP Security Command Center advanced or Azure Defender for Cloud advanced. Cloud-native SIEM: AWS Security Lake + Detective or Google Chronicle or Azure Sentinel — custom detection rules, multi-cloud log aggregation. Container / K8s security mastery: Falco custom rules + Kyverno / OPA Gatekeeper policy advanced + Sigstore cosign signing workflows + Kubescape posture management + multi-cluster security strategies. IaC security mastery: Checkov custom checks development, Terraform security patterns, cloud-native IaC security (AWS CDK + Azure Bicep security). Cloud encryption mastery: KMS envelope encryption patterns advanced, HSM integration (CloudHSM / Dedicated HSM), BYOK / HYOK for compliance, key rotation automation. Secrets management mastery: HashiCorp Vault advanced (Transit / KV / Database / PKI / cloud-native auth methods), External Secrets Operator for K8s, multi-cloud secrets strategy. Compliance frameworks mastery: SOC 2 + ISO 27001 + PCI-DSS + HIPAA + FedRAMP + GDPR + 152-FZ + 187-FZ + CIS Benchmarks automation. Design automated evidence collection systems (Drata / Vanta / Secureframe). Threat modelling for cloud: cloud-specific attack vectors (IAM privilege escalation paths, cross-account attacks, lambda exploitation, container escape, supply chain in cloud), MITRE ATT&CK Cloud Matrix. System design for cloud security: design multi-cloud Zero Trust architecture on the whiteboard, design landing zone security patterns, design multi-region key management strategy, design Zero Trust Network Access (ZTNA). Programming: Python deep (cloud SDK mastery — boto3 + google-cloud + azure-sdk) for custom security automation, Terraform for IaC, bash + PowerShell. Soft: ADRs writing for cloud security decisions, technical writing (cloud security design docs + audit reports), executive communication (cloud security posture to CISO / CTO / Board), vendor evaluations (Wiz vs Prisma vs Orca decision), mentoring Middle Cloud Security Engineers. English for Senior+ MUST — Cloud Security community (fwd:cloudsec / RSA Cloud Security track / CSA) + vendor docs (Wiz / Prisma / Snyk / HashiCorp) are entirely English-speaking. Optional bonus: open-source contributions to cloud security tools (Prowler / Cloud Custodian / Falco / OPA / Kyverno) — sharply increase market value for Big Tech Cloud Security + CSPM/CNAPP vendor hiring. Public speaking at fwd:cloudsec / RSA Cloud Security track — premium for frontier cloud-security companies.