Cloud Security Careers: Advice & In-Demand Skills

My advice to anyone considering cloud security is to treat it as both security and large-scale distributed systems engineering. Modern attacks don’t stay in one app, they move across pipelines, dependencies, identities, and cloud infrastructure.

In my view, this is exactly where the industry is headed: security and infrastructure are converging, especially in software supply chains. AI-generated code is increasing software volume faster than traditional review models can handle, so demand for engineers who can secure cloud-native pipelines will grow sharply. I recently wrote about this trend in the Microsoft Security Blog: https://techcommunity.microsoft.com/blog/microsoft-security-blog/state-explosion-security-problem-in-ai-era-software-supply-chains/4518255

The most in-demand skill area is cloud security engineering with strong systems depth, especially supply chain risk, and detection/response at scale.

But that only works if it is built on strong computer science fundamentals and distributed systems knowledge. — Do Not Skip The Basics –. It’s like mathematics: you cannot install mathematics in your brain using calculator. Real expertise comes from practicing fundamentals until they become second nature.

One piece of advice is to focus on security-led data management and master identity and access controls within a zero trust model. In my experience advising organisations globally, the shift away from perimeter defenses means identity must explicitly verify every query and standing privileges are no longer acceptable.

In addition to technical skills, learn written and verbal skills on how to understand different audiences, conflict resolution methods and offer consultative approach that’s decreasing with AI agents seeping into tech landscape.

The most in-demand skill is strong identity and access management combined with governance as code so you can automate access rules, enforce least privilege, and enable just-in-time elevation. Learn how automated classification, lineage, and access rules work so you can reduce manual approvals and produce audit-ready trails.

Familiarity with continuous security posture and data observability will help you understand various scenarios (internal stakeholders and external parties) and help identify cloud security relevant areas of concerns, identify the risks and help translate those into what matters to the organisation from risk remediation perspective.

Don’t shy away from hands-on projects at the start as that lets you experiment, implement policy enforcement and identity-based access in real systems, because proving control is what leadership and regulators will expect.

My main advice would be: don’t rush into tools too early. First, learn how cloud infrastructure works in practice — networking, IAM, storage, logging, encryption, backups, and common misconfigurations.

The most valuable skill today is a strong, broad understanding and the ability to apply that knowledge in real-world situations. In cloud security, it’s not enough to know the theory. You need to understand how systems are built, where risks typically arise, and how to prevent small mistakes from becoming serious security issues.

One piece of advice is to build depth in one cloud platform, then broaden through patterns instead of chasing every certification at once. Employers remember people who can explain why a storage decision, network rule, or secret handling choice changes the business risk of an application. I would focus on understanding the shared responsibility model in practice, especially where teams assume the platform protects more than it actually does.

The skill most in demand is connecting infrastructure as code with security reasoning. Organizations need professionals who can review deployment logic, catch risky defaults early, and help engineering teams prevent repeatable mistakes. That combination improves delivery confidence and strengthens audit readiness.

One thing I’d tell someone considering cloud security is to spend time understanding how applications are actually built and deployed, not just how they’re secured. The people I’ve seen grow the fastest in this field are usually the ones who can sit down with developers, understand the architecture, and spot risks before a system goes live.

At Zibtek, security conversations today are very different from what they were a few years ago. Companies are running workloads across multiple cloud services, connecting third-party platforms, and introducing AI into everyday operations. Because of that, identity and access management keeps coming up. Knowing who has access to what, and making sure those permissions stay under control, is becoming one of the most valuable skills in cloud security.