What I do as a Cloud Security Engineer
ฝัง
- เผยแพร่เมื่อ 11 ก.พ. 2021
- Job titles in cloud can be confusing to say the least and the delineation between job roles is even more confusing. It's important to understand the role you're striving for so follow me as I take you through my day to day as a cloud security engineer working as a contractor for the government.
📸 Instagram - / andrewroee
🐦 Twitter - / aroesec
🌐 Github - github.com/aroesec
🎮 Discord - / discord
Resources:
CDK Docs - docs.aws.amazon.com/cdk/api/l...
CDK Videos - • Cloud Engineering with...
- • Cloud Engineering with...
CDK Examples Github - github.com/aws-samples/aws-cd...
🚀My PC Build
RTX 3070 Ti Graphics Card - amzn.to/3NVvbZ7
Intel i7 10700k cpu - amzn.to/3IpRIMU
LG 36 inch ultra wide monitor - amzn.to/3NRnbZ6
BenQ Zowie 24.5in 240hz - amzn.to/3Rtf7kC
LIAN OI O11 Computer case - amzn.to/3uAw8PR
AORUS Pro-WIFI MOBO - amzn.to/3AA0FkO
HyperX RAM (32gbs) - amzn.to/3RfMCGN
Corsair RMX Series 750 Watt PSU - amzn.to/3PeLQYH
Ducky One 2 SF - amzn.to/3ylQUE8
🚀My Macbook/Content Setup
Macbook Pro M1 (16 inch) - amzn.to/3usIPw4
Lumix Panasonic Camera - amzn.to/3ylsxq5
Stellar X2 Microphone - amzn.to/3ar53ba
Scarlett 2i2 USB Interface - amzn.to/3yLAwy2
Logitech MX Mechanical Mini Keyboard - amzn.to/3c0GLoR
Logitech MX Master 3 Mouse - amzn.to/3IqgRHg - วิทยาศาสตร์และเทคโนโลยี
![Fc ครับ ขอแนะนำให้รู้จักกับ "น้องเปียโน" l [Nickynachat]](http://i.ytimg.com/vi/HQU6Q_IYTLo/mqdefault.jpg)
Dude, nice video! From one cloud security engineer to another you hit the nail on the head.
Thanks a ton!
Great video!! Very interesting and glad the dog got a second in the video ! 😄 This is the route I’m wanting to go down, Cloud Security Analyst though, less of the actual building. But I need to learn that too, so I know how to review and how things should be.
Glad you like it man! Mia will be on soon
Thanks for this totally non simplified explanation video bro! I have a great concept of what takes place now.
Thank you all for watching!
How can i learn cyber from A
I feel that this talks to me
Thank you for sharing.
So Andrew I'm a little confused what's the difference between a cloud engineer vs a cloud security engineer ??
@@quickstrike2111 That my friend is a good question. It very much depends on the organization you work for as there can be a lot of overlap.
@@AndrewRoe ok thanks for the reply I was just curious cause I want to be a cloud engineer but I have no cybersecurity background
As a cybersecurity lead with 15 years of exp I approve the advices given in this video 👍 Especially the one that states you are not the first person to create a specific solution in 95%, and if you are in those 5% - you can take the existing solutions, take some time to analyse and think and get to the point
Thanks for the video, dude. I am currently finishing my first programs in cybersecurity, and right now I am taking Python courses to be able to automate tasks. Three months ago I started this journey and without a doubt the cloud is what most attracts my attention. I noticed you changed areas, so I hope you're happy where you are now. :)
I still do cloud! Just use it to build user facing apps. Hope everything works out for you!
I really like the real-life example solutions. Very good ideas/project I might also implement.
good luck! Let me know how it goes
I just accepted an offer to work in as a Cloud Cybersecurity Engineer, and I am excited looking forward to the journey. I will ensure to be tuned into this channel in the future for more information.
That’s awesome man!!! So excited for you.
Hey , how’s it been so far?
How’s the job been man?
where to start and what to do
@Andrew Roe @Isaac Francis @POPA It's been fantastic, I've been able to get my hands on a lot. I've helped rebuild the environment using Terraform, and while I was at it I built the entire Security account (SOC) using Terraform as well. I've also been able to get my Solutions Architect and Security Specialty Certs ! I'm looking to get my hands on more automation now with lambda !
Thanks for sharing! This information was helpful.
Glad it helped!
This is insight I can build on, thank you.
Glad it helps, thank you!!
Great breakdown!!!
Thank you!
Subscribed and looking for more career guidance videos on Cloud Security.
Thank you!! Coming soon
Great video bro! I need to make a video for Day in the life of a cloud engineer soon!
do it man!
I kind have the same role which my title is cyber security specialist and this video help me a lot understanding what to expect. I am about to start this monday and I agree about the ambiguity of the role sometimes. Will follow along this channel or even view some old videos just to get an idea.
Good luck!
Great Video Man!
Thank you!
Thanks you for sharing. It is very helpful.
Glad it helped!
I'm a security engineer and this was pretty good.
Thanks man!
Great video! Thank you for sharing!
QQ: what would be the best cert you would recommend as a security engineer?
All of the AWS certs are great to start if you're in cloud!
Down to earth, dirt simple friendly advice! I love the part @ 14:19 where you say, "I had no idea what I was doing" You def past the humility test! 😇 What advice could anyone give for python resources to learn for cloud automation like Andrew mentioned? Thank You and good luck on your journey.
appreciate the kind words. I have a video on the top resources I'd recommend specifically for python if you want to give that a look. It's on the channel.
Very interesting field that I am definitely considering. What kind of salaries have you seen in this field?
Very insightful video; thank you! What motherboard are you using with your PC build?
Much appreciated!
The mobo I have is in the description with a link!
Hey Andrew! I have a pretty off-the-track question for the other side of things. I'm a recruiter looking for a Cloud Security Operations Engineer, what are some engineering positions I could look for outside of people already working in your position that would be solid to reach out to possibly move into work as a Cloud Security Engineer? DevOps? General Cloud Engineers? Would help me widen my search like crazy.
Hey! The answer to this question may vary depending on who you ask as some tittles in cloud are a bit convoluted. For example the role you’re looking for is already a bit strange to me because you’re putting operations and engineering in the same title. To me those are two different things. Is there a job description? In the meantime I’d say that talking to cloud engineers and cloud security engineers are your best bets for right now. Although I’d have to see the job description. Hope that helps!
This is a year later so probably too late as you probably have that covered already but just in case someone else was reading this and had a similar question, yes, DevOps Engineers (and Solutions Architects + Cloud Engineers) are a great bet. You should probably look out for those that have done some security testing during the course of their job functions, look for how familiar they are with secret protection, IAM and stuff like that. There's a good chance folks like that already do some sort of cloud security job functions and would be able to transfer to this field comfortably.
I love cyber security but my communication skills suck, I definitely know I won't be moving up in management. I enjoy the configuration and setting up of servers. Which sub field would you advice that has the least communication and meetings lol?
Saying your communication sucks isn’t an excuse for not working on it. Obviously I don’t know your story but I’d really work on you not accepting “my communication sucks”.
from the perspective of a cloud security engineer could you weigh in on the pros and cons of different types of practical work experience in other technical roles that dont have security as the primary focus and the advantages of bypassing traditional or 'formal' experience by owning a glowing mechanical keyboard?
Hahah I love the last part but, can you explain the first differently. You want to know of ways in which you can get practical cyber security engineering experience while
Working as say a software engineer?
Hey Andrew! Great Video, mate!! I am entering into AWS and aspire to be a cloud security Engineer. I want to know for doing the automation or other solution creation based on CDK, what programming languages are required?
So all you would really need is python and you’d be able to write IaC. But, I write my infrastructure in typescript and my lambdas in python or nodejs, but that’s more preference.
@@AndrewRoe thanks for the information brother!! Really helpful 👍
@@merazhussain6022 appreciate you watching!
This video is helpful thank you.
Glad to hear!
New to your page. Great content!
ThNk you!
Thanks for sharing this kind of info. Appreciate it. Can u please tell how much a cloud engineer make per annum? I would be happy to know
Thanks! Really depends on a bunch of things including where you live.
Hello Andrew. What’s your opinion about, which will be more demanding cloud security vs soc - incident response, malware analysis, siem?
Hey kashif this is a very complicated question what do you mean by more demanding?
How would you compare Information Security Engineering with more the more general Software Engineering field from your personal experience. What would be the most important pros and cons for each?
One (security) is assessing current security posture and creating controls to mitigate risk. The other (software) is heavily focused on getting product to market by writing code.
Hi
I am trying to learn cloud security
NIST 800-53 is a control baseline document (much like CIS controls, but targeted to federal needs), not a framework. NIST CSF is a framework, of which 53 is a tiny part.
NIST 800-53 is a framework.
Great video, you're apsolutely right, Cloud Security cannot be "Cloud police", it should be used as an automated control and prevention
Agreed
Hey Andrew ,
When you say security here ,
Doesn’t your work involve on any firewalls ??
Some yes.
Hi! If you had a year time to get into Cloud Security, what certs or courses would you take in a span of 12 months to get into the domain. Please answer this.
I just made a video on my top certs for 2022. Id check that out.
Hey Andrew great video; between AWS, Azure, and GCP, would you say its best to learn 1 and stick to it through your career? Or how hard is it to adapt to the other 2 if you were to be familiar with just 1?
There’s a lot of similarities between them but I’d say learn one and get very comfortable with it before jumping to others
They are the same services, basically, on each one. They are slightly different. Learn one well, to understand the services it provides, then compare those services to the commensurate offerring of other cloud service providers (CSPs). U’ll find that they all provide pretty much the same thing, with different names. Latency and identifying bounded contexts are the primary issues with cloud solutions, and that is the same with all of them.
hey Andrew, what is cloud security team composed of ? like your team for example, how many of you, what's the hierarchy of functions ?
I'm not in cloud security anymore but my teams have always consisted of a team 2-6 of security engineers and a manager/pm
is Azure Security Engineer Associate cert OR the AWS one enough to get a job or do i need some other degree in the field prior to those exams and certs ?
I’m really not too sure. Those are entry level so you may be able to get an entry level job
@andrew roy, my role is network security engineer (firewall., ltm and proxy )right now in support role, I wanted to enhance my skill , kindly suggest some best way/course
I’ve been watching so many videos about cyber security and trying to wrap my head around what I even want, need to do.
I have no experience what so ever. I have no certifications, and no degree in IT. I only have an associates in arts degree, and have been a co owner of a business for the past 5 years. I’ve gotten so burnt out, and want to change my career path in to something I think I would enjoy more. I start my bachelors in cybersecurity and information assurance in august. Any recommendations on what I should be doing as of now? Cloud security seems to be what I’m interested in, but it all seems overwhelming as of now. I’ve built computers, but never messed with power shell or any programming, but I can learn quickly when it comes to technology.. just feel lost at the moment because there is so much different information. Thanks ahead for a reply, I hope this reaches you!
Hey! Hope I can help in someway here. I really think programming skill is a super power in any of the general technology disciplines but specifically in Cloud. I'd really recommend immersing yourself in Python while you wait and building something you find interesting.
So do you create these solutions from scratch(code) or pick, choose and programme solutions from your cloud provider?
The providers give you frameworks and apis to work with that you use to build out your solutions.
Can we surive in cloud without learning programming langauge . i have been working in network security.
and which cloud streame will be good for me
please advise
I believe you can but I don’t think you should want to.
Can you please tell us the learning path to become a cloud security professional for a beginner?
Please assist on this sir 🙏
@@ghjhghjhjghg Agreed!
Hey all! I’ll make a video about this, this week!
@@AndrewRoe Excited! Notification bell is on!
@@cbg4 thank you! Comes out tomorrow!!
Thanks for the video. Should someone focus on Linux or a coding language like Python as a first step in learning the cloud?
I'd say write python on a linux system. Two birds one stone!
Andrew, for someone who is interested in a Cloud Security Analyst position, what certificates would you recommend I shoot for? I currently have my security+. Prior Cybersecurity Analyst & Tech Writer but I want to go the cloud route.
I have a video on my channel somewhere where I talk about this. But I lean towards Cloud certs such as AWS Developer or AWS Solutions Architect.
Hi Andrew,
I am working as VAPT analyst.I want to learn cloud security.can you tell me which certfication would be best for me as a beginner.
I don't know what a VAPT analyst is but I have a video on my top certs I'd recommend, you can watch that. Although, I'll have to make an updated version for this year..
great vid
Thanks Adam!
Do we need to know SDLC or CI/CD pipeline process in order to get cloud security jobs ? When I check cloud security job postings , I see a lot of companies require skill and not sure if this is needed . This sounds to me more devsecops type of job responsibility
the job titles/responsibilities mix/vary a lot. I'd say it would be very helpful to understand.
Good info.☺
Thanks Ken
Thank you for sharing. I will be watching another of your videos today. And then likely I would be pressing 'that' bar of a button.🙃
Ken Sherman thanks man!!
hey what camera audio equipmet do you use?
My microphone is a stellar x2 plugged into a scarlet i2 interface. My camera is a LUMIX fz2500.
Do clients tell steps what I need to do
for example create a VPC network or compute instance for them
yeah I've been told that before. It's definitely good to at least know how to do those things.
Just want to correct the fact you gave as an example-> “not changing password for 90 days is bad”… This is a very common time period corporate companies adopt before forcing employees to change their word.
I believe Rotation of access keys depends on sensitivity of resource being accessed.
Let me know if it is different at your org
I’m not sure of the scenario you’re speaking of but if I did say that I definitely meant “after 90 days”.
Heya on the topic of granular cyber fields, as the student in computer forensics/cyber I'm trying to find the role that would suit me, could you give some info, links or make a video explaining this in more detail? Thanks in advance!
hey! are you looking for different fields you can go into? Like this video but, different specializations?
th-cam.com/video/cRvzlot6l5I/w-d-xo.html here's a video I made about different roles at a high-level and am going to make more granular one's in the future! Feel free to join the discord if you want to talk!!
@@AndrewRoe Yea like, cyber analytics, pen testers, cloud security engineers etc. branches of cyber
XDN TRACKS I have some videos on that already and will make more in the future!!
@@AndrewRoe I'll check it out, thanks again!
Hi Andrew,
I am working in SOC team and managing WAFs, NGFWs and F5 LTM but I'm getting opportunity to work in cloud migration team where team will be migrating on-prem servers to Cloud.
I'm little confused would it be a good decision to join migration team from future perspective?
Every team is different, it depends on what your goals are for sure.
@@AndrewRoe my goal to work on automation
Anything that lets you get your hands on writing code, do that. Job titles can be ambiguous but anything that gets you writing code, do it.
Hello Andrew thanks for the video.
Am working as aws cloud ops engineer and am looking for cloud security role, what skills should i have and which services are more important.
Hey Vignesh this is a hard question to answer but I do have a video coming out today explaining this
Do we need clearances like US Citizenship to pursue this career ?
Us citizenship isn’t necessarily a clearance but I am a citizen so it may.
Be honest how much of this stuff do you remember and or have to look up
Looking things up is always part of the job.
Am going for a cloud engineer interview. Do you have material I could use to prep for it ?
yes! I do it's in the description of this video
th-cam.com/video/1LjnQimRx7E/w-d-xo.html
So u r doing devops but on cloud. I've heard that there are another roles like splunk engineer on cloud or maintaining security of cloud and upgrading it if needed. Pls make a video on different cloud security engineer roles.
not necessarily, it's a different role entirely in most places. DevOps has SRE under the umbrella, Cloud Engineers don't necessarily do that. They build solutions. I can definitely make that video!
@@AndrewRoe yes bro,make a video on it. Many people have so much confusion about different cloud security roles.
Hey I’m taking my security plus exam end of September and am thinking about taking the AZURE 500 .. would u recommend a different cert other than the 500 to go along with the security plus? .. and any other tools you can recommend to make my resume more attractive to employers ? Like labs etc ?
I’m not a big fan of labs, sure hack the box and others help you understand tooling and more. But I think using Ubuntu or Linux in general as your daily os and learning to code/building projects on GitHub are my biggest things.
In terms of azure 500 I can’t offer much on it, I don’t have any azure certs.
@@AndrewRoe along with my security plus what cert do you recommend to get me into cloud?
@@itzdon8088 I just made a video on certs for AWS but if you’re looking to get into other clouds (which you should experiment and see which one you like), check out the GCP and Azure cert websites.
@@AndrewRoe thanks Ill check out the rest of your videos, so based off what you saying get my security plus , get a cloud certification and do projects on GitHub and learn linux/coding ?
With what you describe, what is the difference between Cloud Security Engineer and Cloud Security Architect?
Sometimes nothing but sometimes a lot. I’ll make a video on it
@@AndrewRoe Thank you. AWS in their IT Role section made a distinction between the two but what you've been doing is basically what they described for the architect role which confused me. Granted the training video is from back in 2017/2018.
@@stevenmcl1 yes the titles can be very ambiguous.
Off tangent but won't selling businesses these automation solutions mean that ultimately there's no requirement for the very security engineers themselves?
Someone needs to maintain these things and integrate internal services to them.
How do you differentiate DevSecOps and Cloud security?
The line can blur a bit but DevSecOps is more security focused.
DevSecOps covers app security, container security, CICD security, includes network security and logs
Cloud Security, specific to cloud and network security policies at the infra level, audits and logs.
@@goodtimesbadtimes5273 the lines can blur a bit on a few of those things.
What are the things need to learn for this job
it's what the video is about.
Having absolutely no experience in this field. Do you think a 3 month cybersecurity bootcamp would help get a job in this field ?
I have never researched cybersecurity bootcamps. But I generally believe that you can achieve anything you want in the space with certifications and personal learning
no way!
Hello Guys! I'm currentlly working as a system support engineer (DC & Collaboration), but mainly I'm focusing on DC). I just want to ask if is it possible for me to pursue a career in cyberSec/cloudSec? Thanks!
it's possible for anyone to pursue a career in cybersec/cloudsec
Hey, I'm applying for a Internship as Cloud Security Engineer what is the future and growth prospects in this domain.
I think they're very high. It's only getting bigger/more popular.
Great video ! I'm looking to get into cloud security but confused how to start? Can you help me with some solutions.
Thanks for the feedback! I'm putting out a series with basic solutions stay tuned!
Whats the difference between cloud security engineer and cloud cybersecurity analyst
One is focusing on building and the other is monitoring the environment (in general)
I have an interview scheduled for this position. Internship position. Could you please help with some wonderful tips.?
You’d really have to describe your situation in order for me to give meaningful tips.
@@AndrewRoe I am new to cybersecurity. Currently a master's student in applied cybersecurity and digital forensics. Have a work experience of 2years as a test automation engineer. Also, have just completed the first semester. Accomplished courses such as: cyber security technology, cyber security management and cyber forensics. Now am actively looking for summer internships 2022. Got a call from a company where the intern role is cloud security engineer.
@@nayanikanandy5371 as a masters candidate I would generally stay away from internships but I don’t have much context into your situation. Work on projects to put on GitHub and above all else if you don’t know something in the interview tell them that you’ll look into immediately after
Hey Andrew I’m a cybersecurity engineer also living in Boulder! Would love to connect!
hell yeah! Nice to hear from you
hey andrew i am a masters studnet and i want to do a project in cloud security could please suggest me one project
thank you
Build an api using lambda and secure it to the best of your ability. Then try to break it to the best of your ability.
@@AndrewRoe thank you
Do you coach individuals?
I do yes.
Are there any certifications you would recommend for someone who wants to get into this field?...I have a CEH cert but I was looking at the (Giac) GSDA cert also....any recommendations?
Absolutely, I’m making a video on this now. Should be out tomorrow!
@@AndrewRoe OK thanks!! I'm starting training at this academy in May with the intent to find a job in this field. They will be training on Azure Linux and Azure Dev Ops and Python. Do you believe that will be of benefit in this career?
Myers Quentin I think you always need to be careful with academies for sure but, if you feel
Comfortable then yes.
@@AndrewRoe I definitely understand , thanks again!!
Myers Quentin absolutely! Appreciate the comments!
👏🏻👏🏻👏🏻
What's up with six sigma in the background?
Used it to study for a certification a while back
,hai i completed the cloud security engineer certificate,now i cleared the interview,they are asking me to,how much salary you expect,i don't know ,so plz anyone knows tell me ,1 yr development experience I have
I really don’t know where you live or your situation so this is hard for me to say. I’m only familiar with US salaries
@@AndrewRoe i am from India,but I don't know how I tell?
@@karuppasamyv6719 unfortunately I can’t help with salaries in India
Hey Andrew, I would really like to connect with you. I'm working toward Cloud Security professional.
we have a discord, it's in the description of the video.
What certifications and education you have?
I have a bunch of certs pertaining to cloud like cloud architect, developer, prac, etc and I have a 2 year degree
@@AndrewRoe cool would you say being an "engineer " vs being an "analyst " is more hands on, technical and challenging.....or about equal.
@@AndrewRoe side note i have my sec+ and aws ccp and getting an entry level cloud or cyber role is HARD AF 🤦🏽♂️ thinking about doing the splunk user and ejpt.
@@MastermindRell that’s awesome, splunk is huge in the space right now and CCP would be a perfect addition for any entry level job.
@@MastermindRell engineer should always be more hands on but I’ve had companies do both.
what salary ballpark can we expect year 1,3 & 5?
Highly depends on location and company.
London based please @@AndrewRoe
i live in the US, I really wouldn't be able to say.
Lool for some reason I forgot and thought you was British, then replayed the video back yep that's not a british accent haha@@AndrewRoe
haha I'm an honorary brit?? I'll take it but no sorry I'm from the US!@@Jay-op4dv
Very Informative...Subbing for more updates
Thank you!
❤️💋 TY
Thank you!
Key Rotation
So true
I thought about going to college for cloud computing... then I heard the way this guy speaks and I realized that I'm too stupid.
nooo you should do it, don't think like that.
How much is your salary?
I'm in the 6 figures
That is super sick ! Thanks ! Did you go to college ?
I do not have a bachelors degree
@@AndrewRoehow did you start your career in IT?what was your journry like?
I've spoken about here and there in a few videos but maybe I'll make one just focusing on that! Good idea.@@himaj7173
hi bro, nice video 😃
i want to be a cyber security specialist, can you please help me 🥺
i have about 8.3 months of experience and i in class 10 😃😊
Thank you!
@@AndrewRoe you are most welcome brother 😃
Why do you have poor people furniture if you’re a CSE?
Please explain what "poor people furniture is" haha
Did you forget to plug in your mic?
i think it's definitely on
Send me some stuff very interested 👍👍
Thank you!
I am Extremely in a LIMBO (Confusion) as why is your Channel is not receiving Subscribers 🙄🙄🙄🙄🙄🙄 Did you had some quarrel with TH-cam......I am serious
Haha thank you. I’m just starting out and trying to make the best content I can.
aside from the role, can I just say you're hot. lol
haha thank you.
For me it sounds like an architect not engineer
i don't really see the difference. a non technical architect isn't very useful on today's engineering teams.
The question should be are the architects useful if engineers eventually do most of architects job 😂
Dislike
Dislike
@@AndrewRoe you didn’t show us what you actually do
@@neverhungryagain2187 I told you what I do. Showing you would be a very extensive video.
Sorry but security architects are the most lazy folks and an over rated career . Worked with tons of security architects and most were naive or relying on several tools and just arrogant
Think this is an over generalization and I'd caution you taking this assumption forward when working with your next security architect.
you're really bad at explaining your own job. Your entire video is just you tossing random thoughts you have regarding your job but not really describing what your job really is about. You keep talking about finding solutions to problems your clients want, but you have not actually describe the problem that you're trying to solve, nor did you describe what a solution might look like. This tells me nothing about what a cloud security engineer do, other than they set some policies about passwords and doing some cost analysis on something or other. you list some things that other people not covering when they talk about this job, but have you listened to your own video and see whether you've actually covered any of those things in this video??
I think I covered things pretty well in the video. If you're looking for technical solutions I build those as well in other videos. Feel free to check them out.