Cloud Security Engineer (Offensive Focus)
For software engineers and sysadmins moving into cloud security. Graduate ready to hunt misconfigurations, exploit IAM flaws, and secure CI/CD pipelines across AWS, Azure, and GCP—aligned with real-world cloud breach scenarios.
// curriculum path
- 1Web App PentestBeginneravailable · start
Build foundational web exploitation skills—SSRF and authentication bypasses are the gateway to cloud metadata services and token theft.
- 2Cloud PentestBeginnerlocked
Learn cloud recon basics: enumerate S3 buckets, audit IAM policies, and understand the shared-responsibility model attack surface.
- 3DevSecOps / AppSecIntermediatelocked
Shift left: audit IaC templates, scan container images, and understand how vulnerabilities enter the cloud deployment pipeline.
- 4Cloud PentestIntermediatelocked
Exploit cross-account trust relationships, assume roles, and abuse OIDC federation—real attacker techniques in multi-tenant environments.
- 5Cloud PentestAdvancedlocked
Master Kubernetes RBAC escapes, privileged pod breakouts, and network policy bypasses—critical for containerized cloud workloads.
- 6DevSecOps / AppSecAdvancedlocked
Attack CI/CD pipelines: exfiltrate secrets, poison dependencies, and achieve supply-chain compromise through automation weaknesses.
- 7Cloud PentestExpertlocked
Execute end-to-end cloud red team scenarios: serverless privilege escalation, multi-service chaining, and advanced OIDC/federation attacks.