A Cloud Security & DevSecOps path from shared foundations through AWS, Azure, and Google Cloud to IaC, Kubernetes, CI/CD, data protection, and incident response. Every module ends with a knowledge check, with no required labs or installations.
The Cloud Security Engineer role, IaaS/PaaS/SaaS, shared responsibility, regions and zones, resource hierarchies, core services, and the control-plane/data-plane distinction. The module builds one mental model that transfers across AWS, Azure, and Google Cloud.
Human and workload identities, policy evaluation, least privilege, MFA, SSO, federation, short-lived credentials, excessive-permission detection, and privileged and break-glass access.
Landing zones, guardrails, segmentation, ingress and egress, private service access, compute and PaaS hardening, data classification and encryption, key management, and safe secret delivery.
Terraform as desired-state declaration, plan and state trust boundaries, secure modules, review and apply, Checkov and Trivy, tfsec status, policy as code, drift, exceptions, and provider and module security.
The container model, image and build trust, vulnerability scanning, Kubernetes architecture, RBAC and service accounts, Pod Security, workload hardening, secrets, NetworkPolicy, admission control, and runtime telemetry.
Secure SDLC and threat modelling, pipeline trust boundaries, SAST/SCA/DAST, secret scanning, cloud OIDC, SBOM and VEX, signing and provenance, and safe approvals, promotion, and GitOps.
Logging strategy, AWS/Azure/GCP audit sources, centralisation and integrity, cloud detections, identity compromise, configuration change, control-plane containment, and forensic readiness, recovery, and lessons learned.
Public storage, key and token theft, IAM privilege escalation, SSRF and metadata/workload identity, pipeline compromise, containers and lateral movement, cross-account trust, and safe validation and removal of complete paths rather than individual symptoms.
Organisations and accounts, SCP/RCP, IAM Identity Center, VPC, KMS, workload identity, CloudTrail, and incident response in the AWS model.
The Entra tenant, management groups, Azure Policy, PIM, managed identities, Private Link, Key Vault, Defender for Cloud, Sentinel, and response.
Organisation, folders and projects, Organization Policy, IAM, service accounts, Workload Identity Federation, Shared VPC, VPC Service Controls, KMS, Audit Logs, and SCC.
Operating model, hierarchies, shared services, federation, guardrails, telemetry, vending, and drift across multiple clouds.
Effective packet paths, transit, hybrid connectivity, DNS, ingress, egress, service-to-service controls, and network telemetry.
Classification, flows, encryption, keys, authorisation, retention, residency, DLP, and response for cloud data.
Cryptographic threat models, envelope encryption, KMS, role separation, key lifecycle, HSMs, PKI, certificate automation, and response.
Responsibility boundaries, revisions and identities, event sources, secrets, networking, retries, idempotency, managed data services, and response.
Inventory and contracts, tokens, BOLA, BFLA and BOPLA, schema validation, limits, gateway-to-backend trust, webhooks, third-party APIs, and response.
Platform-product operating models, module contracts, dependency provenance, state, plan JSON, testing, self-service vending, and drift response.
Decision models, input schemas, Rego and Conftest, testing, enforcement points, exceptions, rollout, failure modes, and decision logs.
Cluster threat models, API access, etcd and Secrets, admission, control plane, kubelets, networking, certificates, auditing, and incident response.
Container isolation, kernel controls, workload attestation, SPIFFE and SPIRE, mutual TLS, mesh authorisation, control-plane trust, Falco, and runtime response.
Triggers and trust contexts, GITHUB_TOKEN, action pinning, reusable workflows, OIDC, environments, runners, attestations, auditing, and incident response.
Platform threat models, trust zones, ephemeral lifecycle, executors, privileged builds, identity, networks, caches, artifacts, fleet supply chains, telemetry, and response.
Inventory and coverage, advisory intelligence, agentless and runtime scanning, image digests, attack paths, prioritisation, patching, exceptions, SLAs, and programme assurance.
Readiness, control-plane and identity timelines, compute and network evidence, Kubernetes and serverless, data-access scope, chain of custody, hypothesis-led hunting, containment, and lessons learned.
Destructive-attack threat models, dependency maps, RTO and RPO, isolated immutable backups, dual control, keys, recovery points, clean rooms, Regional and control-plane failures, and exercises.
Tenant boundaries, context propagation, authorisation, data, runtime, noisy neighbours, administrative operations, and isolation assurance across pooled, bridge, and silo models.
Threat modelling for data, training, models, MLOps, endpoints, RAG, prompt injection, agents, tools, evaluation, and response in cloud environments.
Denial of wallet, cryptomining, egress, serverless and AI cost attacks, cost allocation, anomalies, budgets, quotas, financial response, and a shared FinSecOps operating model.
A cloud-native security platform operating model covering inventory and coverage, posture controls, entitlements and attack paths, runtime, data, finding normalisation, prioritisation, and assurance.
GitOps trust boundaries, repositories and promotion, reconciler identity, multi-tenancy, rendering, secrets, sync, prune, and self-heal, progressive delivery, monitoring, and control-plane recovery.
Internet-edge security from DNS and TLS through CDNs, caches, WAFs, rate limiting, and bot controls to origin protection, L3–L7 resilience, telemetry, and incident response.
Threat modelling, CIS Benchmarks and baselines, NIST CSF/CSA CCM/ISO 27001/NIS2, data and suppliers, exceptions and risk, metrics and evidence, security architecture review, and a final Helios capstone joining cloud, IaC, Kubernetes, pipelines, and response.
