When to Use
- Design and implement org/account guardrails — SCPs, policy constraints, landing zone security
- Harden cloud IAM — roles, trust policies, permission boundaries, federation, break-glass
- Secure cloud networking — segmentation, SG/NSG rules, private endpoints, egress control
- Configure encryption — KMS/CMK policies, default encryption, TLS, secrets managers
- Enable audit and detective controls — CloudTrail/Audit Logs, Config, GuardDuty, CSPM
- Remediate misconfigurations from scans, audits, or Well-Architected security pillar
- Review workload designs for cloud threat patterns (IMDS, public buckets, open SGs)
- Integrate cloud findings into vulnerability and exception workflows
- Support incident forensics with cloud log analysis (with SOC/IR partners)
When NOT to Use
- Company security strategy, policies, board metrics →
cybersecurity - SSO/PAM/SIEM/EDR for corp-wide stack (non-cloud-specific) →
information-security-engineer - SAST/SCA/SBOM and GitHub Actions hardening →
devsecops - Live SOC alert triage and playbooks →
soc-analyst - Cloud telemetry threat hunts and ATT&CK campaigns →
threat-hunter - Authorized exploitation and pentest validation →
penetration-tester - Network/AD/infra pentest from corp paths →
network-pentester - Web/API OWASP testing →
web-pentester - GRC program, audit prep, vendor questionnaires →
compliance-specialist - SOC 2 control narratives and audit binders →
compliance-engineer,cloud-compliance-specialist - Build VPC/RDS without security as primary goal →
cloud-engineer - Landing zone business architecture and migration →
cloud-architect - Cloud program strategy and CCoE investment themes →
vp-of-cloud - Product multi-tenant isolation in app layer →
product-infrastructure-security-engineer - Cloud access tickets and patching →
cloud-system-administrator - Entitlement design, access reviews, federation, PAM →
iam-specialist - Customer security questionnaires, deal compliance fit (architecture) →
solutions-architect
Related skills
| Need | Skill |
|---|---|
| VP cloud program and risk investment themes | vp-of-cloud |
| Corporate security tooling and IdP | information-security-engineer |
| Pipeline and supply-chain security | devsecops |
| Cloud architecture and WAF reviews | cloud-architect |
| Enterprise CCoE and regulated program | enterprise-cloud-architect |
| Cloud resource implementation | cloud-engineer |
| Terraform platform modules | infrastructure-engineer |
| GRC program, gap plans, audit coordination | compliance-specialist |
| Compliance evidence (org-wide) | compliance-engineer |
| Cloud audit evidence and framework mapping | cloud-compliance-specialist |
| SOC triage and playbooks | soc-analyst |
| Active security IR, cloud log coordination | incident-responder |
| Cloud telemetry threat hunts and hunt campaigns | threat-hunter |
| Cloud alert investigation and detection tuning | defensive-security-analyst |
| Pentest validation | penetration-tester |
| Network/AD/infra pentest | network-pentester |
| Web/API OWASP pentest | web-pentester |
| Product tenancy | product-infrastructure-security-engineer |
| Customer deal security/compliance fit memo | solutions-architect |
| CVD and disclosure | technical-program-manager-security-cvd |
| Cloud audit log forensics and super-timelines after preservation | digital-forensics-analyst |
| Security risk registers and treatment prioritization | security-risk-analyst |
| IAM lifecycle, access reviews, federation, PAM | iam-specialist |
Core Workflows
1. Scope and shared responsibility
Cloud security boundaries, provider vs customer duties.
See references/cloud_security_scope.md.
2. Cloud IAM and identity
Roles, federation, privilege escalation prevention.
See references/identity_iam_cloud.md.
3. Network security in cloud
Segmentation, private access, logging.
See references/network_cloud_security.md.
4. Data protection and KMS
Encryption, keys, secrets.
See references/data_encryption_kms.md.
5. Logging, CSPM, and detection
Audit logs, posture management, native detectors.
See references/detection_cspm_logging.md.
6. Architecture review and remediation
Threat patterns, review checklist, fix prioritization.
See references/secure_cloud_architecture_review.md.
Outputs
- Guardrail definition — SCP/policy JSON, exceptions, rollout plan
- IAM policy set — least-privilege roles with trust boundaries documented
- Network security diagram — zones, flows allowed/denied, private endpoints
- Remediation backlog — finding, severity, owner, compensating control
- Control evidence — Config rules, scan exports, sample audit log queries
- Architecture review notes — risks, required controls before launch
Principles
- Deny by default — explicit allow for network and IAM
- Security as code — guardrails versioned and reviewed like application code
- Detect and prove — every preventive control has a detective check
- Break-glass is rare and monitored — not a bypass for convenience
- Minimize blast radius — account segmentation and permission boundaries