Security¶

Cloud security across pillars: shared responsibility, zero trust, secrets, threat detection, compliance, and the certs that test it. Security is the topic with the highest stakes per character of code.

flowchart TB
  IDENTITY[Identity:<br/>users, roles, federation, MFA, PIM]
  NETWORK[Network:<br/>VPC, security groups, firewalls, WAF, zero trust]
  DATA[Data:<br/>encryption at rest / in transit / in use, KMS, DLP]
  OPS[Detection + response:<br/>GuardDuty / Defender / SCC, SIEM, IR]
  GOV[Governance:<br/>SCPs / Org policies, compliance frameworks, audit]
  IDENTITY --> SCC[Security posture<br/>+ findings]
  NETWORK --> SCC
  DATA --> SCC
  OPS --> SCC
  GOV --> SCC

Learn¶

• Shared responsibility model - who secures what, per service tier
• TLS and HTTPS - encryption in transit
• IAM explained - the foundation of authorization
• Guardrails and safety - GenAI-specific, but the principles generalize

Compare¶

• Security tools - GuardDuty vs Defender vs SCC, secrets managers, WAFs
• Identity and IAM services

Reference¶

• Architecture pattern: Zero Trust
• Compliance: SOC 2
• Compliance: HIPAA
• Compliance: PCI DSS
• Compliance: GDPR
• Compliance: FedRAMP

Build¶

• Implement zero trust - identity-aware proxy, MFA, least privilege end-to-end

Certify¶

Foundational - Microsoft Security, Compliance, and Identity (SC-900) - CompTIA Security+

Cloud security specialties - AWS Security Specialty (SCS-C02) - Azure Security Engineer (AZ-500) - Microsoft Security Operations Analyst (SC-200) - GCP Cloud Security Engineer - IBM Cloud Security Engineer

Vendor-neutral - CCSK v5 (Cloud Security Alliance) - CISSP (ISC2) - 8-domain capstone, the gold standard - CCSP (ISC2) - cloud-focused - CompTIA CySA+ - ISACA CISA - audit - ISACA CISM - management

Kubernetes security - CKS - Certified Kubernetes Security Specialist - KCSA - Kubernetes and Cloud Native Security Associate

Network and offensive - Cisco CCNA - covers basic security - Palo Alto PCNSA - firewalls - Offensive Security OSCP (PEN-200) - hands-on pentest - GitHub Advanced Security - SAST/secrets/dependency scanning

HashiCorp - Vault Associate - secrets management - Boundary Associate - identity-aware access

Roadmap¶

The career-track view lives in Security Engineer roadmap.