someone in our Discord his name is Chad asked me about the best way to become a cloud security engineer I tried to answer this question but I quickly realize that the answer is not straightforward because as a cloud security engineer people expect you to not only provide security recommendations on how to secure the cloud but they also want you to know how to configure those security recommendations and settings now having said all of that cloud engineering and cyber security are the two highest growth carriers at the moment they offer the highest salaries with lots and
lots of career progression and sometimes with the option of remote work for some organizations so to solve this issue I created a step-by-step road map that will give you the skills of both cloud and cyber security in the fastest way possible whether you have some cyber security experience or some it experience or if you're someone who's brand new without a degree without any it or coding or networking knowledge this is the video breakdown but not only that I will also be sharing with you the top three mistakes that people make as they are trying to
become Cloud Security Professionals let's get into it so we need to start to build our foundation in both cyber security and Cloud both at the same time the best and quickest start in my opinion is the Microsoft cyber security analyst certification because it will not only introduce you to the basics and foundations of it networking but it will also teach you how to use the Azure Cloud which is the Microsoft Cloud solution that it's extremely popular in the industry this search will cover your basis in terms of General it knowledge and networking so don't worry
about doing things like comp A+ or CCNA or Security Plus if you've done those certifications that's perfectly fine by the way these are good skills to have but doing this certificate will quickly introduce you to those Concepts and give you what you need to become a cloud security engineer now I did a deep dive into this certification in this video so you can watch it for a more detailed view of the certification but before we move on I know you might have the question of so what if I did the Google cyber security certification do
you still need to do the Microsoft cyber security analyst certification to be honest it really depends if you feel like you're confident with the foundational Concepts you might be missing that introduction to Microsoft Azure so I want you to somehow learn the Microsoft Azure before jumping into the next recommendation alternatively you can still do the Microsoft cyber security analyst even if you've done the Google cyber security certificate because it will give you a chance to revisit those topics make sure you understand them really well but you'll also be able to finish it really quickly and
you will get a chance to practice with the Microsoft Azure Cloud now this is not the only reason I'm recommending the Microsoft cyber analyst certificate but the most important reason is that at the end of this certificate you get a free practice exam for the Microsoft sc900 exam which is the Microsoft security compliance and identity fundamental certification this way you can finish the Microsoft cyber analyst certificate learn about cyber security but also get an additional certification from Microsoft that will signal to potential employers that you're someone who have Cloud security skills that you are serious
about pursuing a career in Cloud security while keeping in mind we are still at the beginning of our journey but this is where the fun really begins when we do practical projects I don't want you just to pass certifications especially multiple choice certifications because as I said in the beginning of the video being a cloud security professional you need to know how to configure those security recommendations in the cloud you can't theorize your way around it and the best way to get those Hands-On skills is by doing what we refer to as guided projects those
are projects designed to get you to practice some of the concepts that we see in the industry but more importantly you get to improve your confidence which will enable you to apply to more jobs get into interviews and land your first Cloud security job the first project will get you to create a virtual machine on the Microsoft Azure cloud and you will deploy a web server on that virtual machine it's a really quick introductory project it will take you two to four hours to finish but it's a great classic project that even when I was
learning Unix long time ago one of the first tasks that we used to do we used to install a web server on a Linux machine so now you get to do it in the cloud similar concept not only that it will get you more comfortable of spinning your own Azure cloud and configure and deploy things in the cloud the second project that I want you to do will get you to secure an SQL database in the Microsoft Azure Cloud this is a cloud security task and as you will see when you do the project most
applications noway live in the cloud for example your banking data is stored somewhere on an application in the cloud that the Bank owns which ultimately resides in a database so this is a crucial task that you will be performing as a cloud security engineer and it will look great on your resume or your CV and this is how I want you to add it on your CV so under a section called skills add these keywords to your CV and then have another section called projects where you have bullet items for each project that you did
I know many people get so concerned about HR filters and keywords well these are keywords having Microsoft Azure or SQL Security on your CV is something we look for as hiring managers so trust me with this one guided projects is the single best thing that you will do for your career and your development and this brings me to the first mistake that people make when they're trying to land their first Cloud security job people tend to do a lot of intermediate and even sometimes Advanced certifications that are multiple choice based Without Really spending the time
configuring things in the cloud this will lead to a lot of bad habits but you will also tend to forget a lot of the stuff that you learn but a lot of the things that you memorize to pass the exam will not make any sense to you things will only make sense when you put them to practice only when you get to configure these settings and configure these security recommendations that all of this Theory will make sense to you now in this part we will do a deep dive into securing the cloud and we will
pass an intermediate SL Advanced Cloud security certification the Microsoft Azure security engineer associate is a fantastic certification for you because the topic of this certification pretty much mirrors the tasks that you will do as a cloud security engineer so so this certification is probably the one that will prepare you the most to perform Cloud security engineering tasks this is a fantastic training that will prepare you to pass this certification it includes a practice test at the end but not only that it is full of opportunities to practice all these Concepts in a lab so you'll
get to spin up Microsoft azour cloud and you'll get to configure all of these security settings because as you're applying all of these Concepts in a practical environment things will make sense all of these concept that you've learned will get reemphasized which will make you a lot more confident in an interview setting because you will know what you're talking about you can quickly come up with scenarios because you've done them practically so if we look at the content of the certification part one is secure access with azour active directory azour ad is the domain controller
that lives in the cloud there is 100% chance that you will run into active directory as a cyber security professional so this part will cover this really nicely for you it will show you what an azour security engineer do it will tell you a little bit about the azour 500 exam that you will pass after this course and then it will do a deep dive into azour active directory then you will explore how to manage user access within the aure ad in fact last month I was helping an organization that got compromised and upon investigation
we found that the reason that they were compromised was without user permissions and identity in general in the cloud was not configured properly this happens a lot more than you think people spin up these Cloud instances without spending enough time and resources into securing users and permissions which are all done using azour ad you will also get to configure multiactor authentication and passwordless authentication again these are all Concepts we ask about in the interviews and then at the end of the first module you have a project to practice everything that you've learned part two is
identify protection and governance this is another Deep dive into identity and access within the cloud again extremely important topic within the cloud and one that I see organizations struggle with the most so the fact that you're getting proficient with this at this part of your career is extremely valuable you will also get introduced to some fairly advanced concepts such as role based access control and how to implement that in the cloud you will also get to understand privileged access management and how this applies to Azure ad so as you can see as you're going through
it you are learning fairly Advanced cyber security Concepts and you're getting a chance to applying them in the cloud this is pretty much what a cloud security professional does and as you can see this is why Cloud Security Professionals get paid High salaries because they need a lot of skills they need to be comfortable with a lot of Technologies and there is always demand for cyber Security Professionals with Cloud skills the third part is called Implement platform protection this is where you'll get to reinforce some of the network security Concepts that you've learned earlier in
your Microsoft cyber security analyst so you'll get to learn how to configure firewalls within the cloud and what that means within the context of cloud and also some advanced concepts such as defense in depth you may have heard about it you may have learned it but here you'll get to see how it's actually applied in the real world in the Microsoft Azure cloud and then you'll get to configure kubernetes again you may have not heard of this before but kubernetes is something that cloud Engineers know and are familiar with so you will get introduced to
that but not just from an engineer point of view but from a cyber security point of view if you get a chance to work in a large environment and their use cities you will be the one who will secure that for the organization course 4 goes through application security but within a cloud context so in the cloud we deploy applications as the cloud security professional you are not the one who deploys these applications but you are the one who configur security for those applications and this includes encryption in those application and how to exchange and
store those encryption Keys you'll also get introduced to API and API Security in fact there was a high-profile company that got hacked in Australia and the way that got hacked is through insecure apis so in this course you'll get introduced to what apis are and how to secure them and course five is all about securing data address and in that again you will go through encryption but you'll also go through how to secure the SQL database which you've got some practice with in the Practical project that I introduced earlier so here you get a chance
to explore this in a broader sense course six is managing security operations this is the bread and butter of cyber analyst so if you're a cyber security professional who deals with stopping cyber attacks detecting cyber attacks well a huge part of detecting and stopping cyber attacks is the cloud because many if not most of those attacks nowadays happen in the cloud so here you'll get introduced to some of the Microsoft Solutions on how to detect cyber attacks such as the Azure Monitor and Microsoft Defender you will also get introduced to Microsoft Sentinel which is a
seam similar to Splunk in fact it's becoming increasingly popular so this is a fantastic chance to learn Sentinel and practice with Microsoft Sentinel you will even get a chance to do some threat hunting so if you haven't done threat modeling or threat hunting and you don't even know what there is this course will teach you these concept but it will also teach you how to perform them in the cloud and then in course seven you will get a practice exam exam to pass your B at 500 exam again extremely popular exam highly in demand you
can get a really nice job after passing this exam and doing the stuff that I've mentioned earlier but not only that there is a Capstone project which is my favorite part of the course because you get to put all of these Concepts together and you get to implement them using a Hands-On project now in part four I want to show you the different careers within Cloud security noticed I've used the word engineer in the title of this video because the way Cloud security professional are viewed is that they are Cloud Engineers who understand cyber security
they are individuals who know how to set up the cloud how to configure the cloud but they have deep understanding of cyber security and they know how to implement those cyber security recommendations within the cloud now broadly speaking there are three specializations within the cloud the first one and the most common one is the one that I explained where you are a cloud security engineer you implement security recommendations within the cloud now the second one a cyber security consultant where you advise different organiz ations on cyber security issues and as part of your job you
may be asked to advise organizations on cloud security issues in fact this is what I do I'm not a cloud security specialist but I'm a cyber security consultant and a lot if not all of my clients use the cloud in one way shape or form so I end up needing to have conversations with them about the cloud I give them Cloud recommendations I do Cloud assessments and by the way I did a really nice day in my life as a cyber security consultant in this video if you're curious on what my day looks like and
the third one you could be like I said a dedicated cyber security analyst who work in an organization and your job is to respond to attacks to threats you're more of a blue team professional but as part of your job you will need to deal with the cloud so you will need Cloud security as a skill not necessarily A specialization for example you might be dealing with a Cyber attack against an application that lives in the cloud so you will need to understand how the cloud works so you can analyze that attack and perhaps stop
that attack in a bigger organization you could be a cyber analyst specializing in the cloud but more often than not you're usually a blue team professional or a cyber analyst who looks after the cloud as part of their job which brings me to the second mistake that people make with Cloud security which is being extremely narrow in their job search this one actually drives me crazy so they'll do the certification they will study hard they will do all the hard work but when it comes to job search they insist that they want to perform an
exact job they have this imaginary job where all they do is just designing Security in the cloud so unless the title says design Security in the cloud they don't apply they don't like it or for example they get hired as Cloud security professional but then the actual job doesn't match the imaginary job description they had in mind and this is a recipe of not only failing in your Cloud security career but also it's recipe to be perpetually upset and unhappy so what I really want you to do is to just be a little bit more
flexible with your approach and understand that cloud security can be its own specialization but it can also be a skill that you get to use as a cyber security professional and that sometimes the job is not what you imagine it's not possible for the job to be exactly what you want it to be every single day sometimes you'll get to work on exciting things but other times you will have to do some boring tedious things we all have to do it I have to do it that's just the world we live in so be a
little bit more flexible now you put water into a cup it becomes the cup you put water into a bottle it becomes the bottle you put it in a teapot it becomes the teapot now water can flow or it in Crash be water my friend now in part five I want you to expand your knowledge at this point you might be wondering why did I choose Microsoft Azure what about Amazon AWS what about the Google Cloud what about the Oracle Cloud well remember in this video I'm trying to get you the fastest way possible for
you to build the skills of cyber security and Cloud at the same time it just so happened that the training available that goes over Microsoft is just a little bit higher quality than the ones available for AWS that's not to to say the AWS training is bad it's great it might just take you a little bit longer to familiarize with this concept especially if you're someone with no it degree or with no technolog and you trying to change careers from a different career into cyber security Now the good news if you've done all of the
certifications that have recommended so far you'll be very confident with Microsoft Azure the skills are extremely transferable the concepts are exactly the same the only difference is the naming convention so the name of the storage instance with an Azure is different in AWS it's called S3 bucket it's just different namings for the same thing which means the best way for you to learn Amazon AWS is through guided projects notice I want you to do projects with Amazon AWS before even doing any trainings I want you to think like an engineer I want you to think
on your feed and try to research topics that you don't know because this is what happens in the real world we don't always have training available for new problems that we face and trust me you'll have no problem finishing these projects the first one to create a virtual private Cloud within Amazon WS again as you go through these projects you will realize that you are already familiar with what a VPC is it just has a different name with Microsoft aure and the second project is a hosting project where you will host a web application on
an Amazon AWS very very similar to the one that you did with Microsoft Azure except you'll do it with AWS and you will see how your skills are extremely transferable and this way you will get to add Amazon to AWS to your CV now the popular certification from Amazon AWS that I want you to pass is the AWS security specialty it's equivalent to the a 500 from Microsoft same difficulty extremely similar topics unfortunately there is no cheap training from corsera that covers this the one that I used to recommend is from acloud Guru which is
the one that I recommend today however things have changed a cloud Guru got acquired by plural sites so things are not how they used to be but it's still good quality if you've reached this stage I highly recommend that you also do this training because you'll get a chance to review exactly the same topics that you've learned with Microsoft you'll get to apply the same concept with an Amazon AWS which will improve your confidence it will expand your knowledge and will ultimately lead you to land your first Cloud security job now again the third one
there is an equivalent certification from Google Cloud Google cloud is less popular than Microsoft Azure and Amazon AWS but it's still widely used in the industry so this one is optional if you have time and you want to further expand your Cloud knowledge good news is it's available through corsera it's cheap to complete it has practical project and it has all the good stuff that you've done in your Microsoft AO certificate just with the Google Cloud again if you've reached this stage you will be able to finish this one quickly because you are already familiar
with all of these Cloud security Concepts things will just have slightly different names in the Google Cloud but that's about it but this brings me to the third biggest mistake that people make with Cloud security is that some individuals are wedded to one technology they refer to themselves as the AWS guy or the Azure girl they only want to work with one technology they want to specialize in AWS they want to specialize in Microsoft Azure there is nothing wrong with that but I think you're missing out if you follow this approach you're leaving a lot
of opportunities on the table as I've explained all of these Cloud platforms are extremely similar one is not better than the other they pretty much do the same things so in my opinion a successful cyber security professional is one who's adaptable is one who have depth and bread of knowledge don't be wed to one technology or one vendor because vendors come and go and because in the real world you will be asked to deal with more than one technology so if your organization for example brought up Google cloud and they ask who knows Google Cloud
I want you to be the one to put your hand up and say yes I will take this opportunity on and this is how you'll progress in your career this is how I was able to jump up quickly how I was able to learn quickly and how I was able to have a breath of knowledge now remember Cloud security is a specialization but it's also a skill that you can have as a cyber security professional but if you're wondering what other cyber security professional specialization are like what do they do well I broke them down
all in this video where I've listed every single cyber security specialization I've listed the task that they do what their day-to-day look like but I also listed the pros and cons of each specialization so please watch this video and I'll see you there
