Hiring a cloud security engineer: AWS, Azure, GCP

Hiring a cloud security engineer has become a priority for many companies that migrated fast, sometimes faster than their security. Yet the title covers very different realities depending on the provider, the maturity of the platform and how teams are organised. This guide helps you scope the role, know what to check and assess candidates on what they can actually do.

Define the role before looking for a profile

"Cloud security" can mean at least three jobs. Mixing them up is the first reason these hires fail.

The security-minded platform engineer. They build and maintain the foundations: account or subscription structure, identity management, networking, centralised logging, guardrails applied by default. They write a lot of infrastructure as code and work daily with platform or SRE teams.

The cloud security engineer in a control role. They assess the existing posture, track misconfigurations, prioritise fixes with product teams and feed discussions with leadership or auditors. Their main tool is often a posture management product, but their value lies in getting things fixed.

The cloud detection and response profile. They work with provider logs, write detection rules suited to managed services and can investigate a compromised account. They work closely with the SOC.

A small company often expects a mix of all three. That is possible, but say so clearly and state the main focus. A candidate who thinks they are joining a platform team and discovers a role centred on compliance dashboards will leave quickly.

Three more questions complete the scoping:

Which provider? AWS, Azure and GCP share principles, but their identity models, resource hierarchies and logging differ. A multicloud environment calls for someone who can reason beyond a single console.
What maturity? Building the foundations of a new platform and taking over a patchy existing one require different strengths.
Where does the role sit? Reporting to the CISO, the CTO or the platform team: that choice decides how much real power the role has to change practices.

The technical skills to check

Expectations depend on the role's focus, but a common core appears in almost every case.

Identities and permissions. This is the heart of cloud security. The candidate must understand access policies, roles, service identities, federation with the corporate directory and least privilege applied in practice.
Environment structure. Separation of accounts, subscriptions or projects, organisation-wide policies, handling of production and test environments.
Cloud networking. Segmentation, private endpoints to managed services, internet exposure, filtering and gateways.
Logging and detection. Knowing which logs to enable, where to centralise them, how long to keep them and what to look for during an incident.
Data protection. Encryption, key management, secrets management, storage exposed by mistake.
Infrastructure as code. Reading and writing infrastructure code, building security checks into deployment pipelines rather than fixing things by hand afterwards.
Containers and Kubernetes, if your platform uses them: workload isolation, service account permissions, image security.

The table below helps you focus the assessment on the role you need.

Main focus	Check first	Warning sign
Security-minded platform	Identity and organisation design, infrastructure as code, preventive guardrails	Fixes everything by hand in the console, with no traceability
Control and posture	Prioritising findings, understanding real risk, getting fixes done	Cannot explain why a configuration alert matters or does not
Cloud detection and response	Provider logs, cloud attack scenarios, account investigation	Applies on-premises network reflexes without accounting for managed services

The skills people forget to check

The shared responsibility model

A good candidate can explain, service by service, what the provider handles and what is yours. That understanding avoids two opposite mistakes: believing the provider secures everything, or trying to control everything yourself until teams are blocked.

Working with developers

In the cloud, security happens through the teams that deploy. The engineer should offer reusable patterns, automated checks people understand and well-governed exceptions. Someone who can only say no or open tickets will have little effect on the real posture.

Balancing security, cost and speed

Enabling every log, encrypting with customer-managed keys, isolating every application: each measure has a financial and operational cost. Ask the candidate how they prioritise. The answer says a lot about their maturity.

Understanding regulatory obligations

Depending on your sector, the NIS2 directive, customer requirements or a hosting qualification process may weigh on the platform. The candidate does not need to be a lawyer, but they should be able to turn a requirement into concrete controls. Our article on the profiles to hire for NIS2 covers these needs.

Assess through practice

Cloud provider certifications show effort and knowledge of the platform, but some of these exams are question-based. Our article on certifications in hiring explains how to read them. To measure real practice, nothing replaces a hands-on exercise.

An effective process fits in four steps:

A first conversation about background, providers used, the size of environments managed and the preferred focus.
A time-boxed practical exercise on a dedicated test environment, never on your production: a deliberately misconfigured account to analyse and harden, or a piece of infrastructure as code to review.
A peer review: the candidate explains their priorities, what they left aside and how they would get the fixes accepted by the teams.
A final conversation with the manager about the organisation, any on-call duties and prospects.

A few useful questions for the peer review:

"You are handed an unfamiliar cloud account. What do you look at in the first hour?"
"A team needs broad access to move fast. How do you frame it without blocking them?"
"An access key was pushed by mistake to a public repository. What do you do, and in what order?"
"How do you prevent storage from being exposed publicly, rather than detecting it afterwards?"

To build a fair scoring grid, see our guide to assessing cybersecurity skills. If the role includes offensive work, the cloud section of our pentester interview questions can complement the exercise.

The costly mistakes

Hiring on a list of certifications. It filters out strong candidates who learned in production and lets through people who have never run a real environment.
Requiring expert level on all three providers. Look for real command of your main provider and the ability to learn the others.
Confusing a cloud administrator with a cloud security engineer. The first keeps the platform running, the second makes it harder to compromise. The two overlap, but the security bar is not the same.
Isolating the role. Without ties to platform and product teams, the engineer produces reports nobody applies.
Dismissing people from other backgrounds. System administrators, DevOps engineers and developers make excellent cloud security engineers. Our guide to hiring career changers explains how to assess that potential.
Letting the process drag. These profiles are in demand. A long process with no feedback between steps loses you the candidates you had shortlisted.

What attracts a good cloud security engineer

Pay matters, but other factors often weigh as much in the decision:

a clear mandate and leadership support to change practices;
a platform where automation is encouraged, with time to build rather than only to control;
access to test environments and a budget for training and certifications;
healthy working relationships with platform and product teams;
transparency on on-call duties and remote work.

Present these from the first conversation, with the same precision as the technical requirements.

In short

To hire a cloud security engineer, first choose the role's focus (platform, control or detection), the main provider and where the role sits in the organisation. Check identities and permissions, logging, infrastructure as code and the ability to work with developers. Assess on a dedicated test environment followed by a peer discussion, and keep the process short.

Looking for a cloud security engineer and want to avoid a costly mismatch? At Cyber Recrut, a recruiter and a security practitioner scope the need with you, then our shortlisted candidates prove their skills on hands-on labs close to your environment. See how we work or share your hiring need.