How to Become a Cloud Engineer: Skills, Certifications and a 9-Month Roadmap (2026)

If you're working out how to become a cloud engineer, start with Linux, networking and one scripting language, then go deep on a single cloud (AWS or Azure) and earn its associate-level certification. After that, add Terraform, containers and CI/CD, and build three portfolio projects you can explain line by line. At 10 to 12 hours a week, most people reach junior-role readiness in 6 to 9 months.

Key Highlights of How to Become a Cloud Engineer

• A 9-month cloud engineer roadmap with weekly hours and an exit test per phase.
• A skills table showing beginner, junior and mid-level expectations across eight areas.
• A certification order for AWS, Azure and Google Cloud, plus CKA and Terraform Associate, with fees and formats taken from the official exam pages.
• Four portfolio projects with concrete deliverables.
• Separate starting points for freshers and for sysadmins, developers, network engineers and testers switching into cloud.

Introduction to the Cloud Engineer Role

Cloud engineers build, run and repair the infrastructure that applications sit on, whether that's in AWS, Microsoft Azure or Google Cloud. The job spans networks, virtual machines, storage, databases, identity, deployment pipelines and the monitoring that warns you when something breaks. You'll also see the same work advertised as "cloud computing engineer".

If IaaS, PaaS and SaaS still blur together for you, read the cloud computing reference modelfirst. This guide is about the practical side: what to learn, in what order, and how to show an employer you can do the work.

A lot of people try "get certified and apply" and wonder why the calls dry up. Junior cloud interviews tend to ask you to debug a security group or talk through a Terraform plan, so the roadmap below is built around those tasks and uses certifications as checkpoints along the way.

What Does a Cloud Engineer Do?

Most of a cloud engineer's week goes on provisioning infrastructure through code, keeping production healthy, handling access requests and trimming cost. Add on-call shifts, the odd Kubernetes upgrade and a cost review, and you have a fairly typical week.

To make that concrete, follow one realistic ticket from start to finish:

1. The request. A product team needs a new staging environment for an API, with a PostgreSQL database and a public HTTPS endpoint.
2. Design. You pick a VPC with two public and two private subnets across two Availability Zones, an Application Load Balancer, ECS or EKS for the containers, and Amazon RDS in the private subnets.
3. Code. You add a Terraform module to the infrastructure repository, open a pull request, and attach the terraform plan output so a reviewer can see exactly what will be created.
4. Pipeline. After approval, the CI pipeline runs terraform apply with a role that has only the permissions it needs.
5. Verify. You check the load balancer health checks, confirm the database is not publicly reachable, and add CloudWatch alarms for 5xx errors and CPU.
6. Hand-off. You update the runbook and tag resources with team and cost centre.

Types of Cloud Engineer Roles

"Cloud engineer" is an umbrella title. The roles under it overlap, but people usually arrive in each one from a different direction.

The cloud engineer usually owns the platform, while the DevOps engineer owns the path from commit to production. If pipelines interest you more than infrastructure, read how to become a DevOps engineer alongside this guide.

How to Become a Cloud Security Engineer

It's rarely a first job, because it's hard to secure systems you've never built. The usual route is to follow the roadmap below, spend a year or two as a cloud engineer, and then specialise in IAM policy design, key management, detection and compliance. Our guide to cloud-native security and DevSecOps shows where the specialism is heading.

Cloud Engineer Skills You Need

You need working knowledge across eight skill groups and real depth in two or three of them to land a junior role. The sections below take each group in turn, and the table at the end shows what each looks like at beginner, junior and mid level.

Linux and Scripting

Most cloud workloads run on Linux, so get comfortable with ssh, permissions, systemctl, journalctl and the logs under /var/log. Bash is fine for glue scripts. For anything longer, switch to Python, for example, a boto3 script that lists untagged EC2 instances.

Networking Basics for the Cloud

Beginners get stuck here more than anywhere else. You should be able to explain CIDR notation (why a /24 gives you 256 addresses and a /16 gives 65,536), what separates a public subnet from a private one, what a NAT gateway does and how DNS resolution works. In AWS, you should also know why a security group is stateful and a network ACL is stateless.

One Cloud Platform, Learned Deeply

Choose AWS or Azure and stick with it for at least six months. Get properly comfortable with compute (EC2 or Azure VMs), storage (S3 or Blob Storage), networking (VPC or VNet), identity (IAM or Microsoft Entra ID), managed databases and monitoring. If you go with AWS, this overview of what AWS is and how its core services fit togethergives you the map.

Infrastructure as Code with Terraform

Teams provision infrastructure through code so every change gets reviewed and can be repeated. Terraform works across clouds, and AWS CloudFormation and Azure Bicep are the native alternatives. Learn the init, plan, apply, destroy cycle, remote state with locking, modules, and per-environment variables.

Containers and Kubernetes

Start by writing a Dockerfile with multi-stage builds and pushing the image to a registry. Then learn enough Kubernetes to deploy an app, expose it with a Service and Ingress, and make sense of kubectl describe pod when a pod won't start. Amazon EKS and Azure Kubernetes Service (AKS) manage the control plane for you. Many people find this the steepest part of the roadmap, and if you learn better with guided labs, Simpliaxis's Docker and Kubernetes trainingwalks through it step by step. If containers are new to you, start with what Docker is and how it works, then this introduction to Kubernetes.

CI/CD Pipelines

Build a pipeline that tests, builds and scans an image and then deploys it, and send your Terraform changes through the same review gate. GitHub Actions is the easiest place to start. If you later lean towards automation on AWS, CodePipeline and deployment strategies are the next things to study.

Monitoring and Cloud Cost

You need logs, metrics and alerts from CloudWatch, Azure Monitor, or Prometheus with Grafana. You also need to be able to read a bill. The usual leaks are idle instances, unattached disks, NAT gateway data charges and old snapshots.

Security and IAM

Least privilege is the habit that matters most. Use roles instead of long-lived keys, turn on MFA, encrypt storage and keep secrets out of Git. A storage bucket left public or an IAM policy with a wildcard where a specific action belonged is one of the most common ways a small slip becomes a security incident.

Cloud Engineer Skills by Level

How to Become a Cloud Engineer: Step-by-Step Roadmap?

The roadmap below takes nine months at 10 to 12 hours a week; with 20 or more hours, it compresses to about five. Each step ends with an exit test, and it's worth passing that test before you move on, even if the next topic looks more exciting.

Step 1: Linux, Networking and Git (Months 1 to 2)

Use Ubuntu every day and practise permissions, processes, services, cron and SSH keys. Keep working on subnetting until you can split a /16 into /24s on paper without looking anything up. Push every script you write to GitHub.

Exit test: Set up a Linux server, harden SSH, install Nginx, and serve a page over HTTPS with a free certificate.

Step 2: Python or Bash Automation (Month 2)

Write five small automation scripts. Good candidates are a disk usage alert, a backup to object storage and a URL health check.

Exit test: One script must call a cloud API through an SDK such as boto3 or the Azure SDK for Python.

Step 3: Your First Cloud Platform and Fundamentals Exam (Months 3 to 4)

Open an account, and set a billing alarm on day one. According to the AWS Free Tier page, new free plan accounts get $100 in credits on sign-up and can earn up to $100 more, and the free plan account closes after 6 months or when the credits run out, whichever comes first.

Build everything in the console first, then rebuild it with the CLI. If you'd like a checkpoint, sit the fundamentals exam in month 3 or 4.

Exit test: Deploy a two-tier web app (EC2 or Azure VM behind a load balancer, plus a managed database) and explain every security group rule.

Step 4: Associate-Level Certification and Terraform (Months 4 to 6)

Study for AWS Solutions Architect Associate or Azure AZ-104 while you rebuild your Step 3 app in Terraform. The exam teaches you what the services do. Terraform teaches you how teams actually deploy them.

Exit test: terraform destroy and terraform apply your whole environment in under 15 minutes with zero console clicks.

Step 5: Containers, Kubernetes and CI/CD (Months 6 to 7)

Containerise your app, push the image to ECR or Azure Container Registry, and deploy it to EKS or AKS. Not sure where Docker stops and Kubernetes takes over? Read Docker vs Kubernetes before you start. Then build a GitHub Actions pipeline that tests, builds and deploys on every merge.

Exit test: A code change merged to main reaches the cluster without you touching anything.

Step 6: Monitoring, Security and Cost (Month 8)

Add dashboards and alarms, centralise your logs, and write least-privilege IAM policies for the pipeline. Finish by producing a cost estimate with the provider's pricing calculator.

Exit test: Break something deliberately (stop the database) and confirm an alert reaches you within five minutes.

Step 7: Portfolio, CV and Applications (Month 9)

Polish three or four projects with READMEs and diagrams, and rewrite your CV around what each project achieved. Then practise explaining one project in under four minutes, out loud, until it no longer sounds rehearsed.

Cloud Engineer Roadmap at a Glance

Cloud Engineer Certifications by Platform

A cloud engineer certification shows you've studied a syllabus. It doesn't show you can run production, which is why each one should come with a project you can point to. The figures below are from each vendor's official exam page, checked in October 2026.

Recommended Certification Order

On AWS, take Cloud Practitioner first (you can skip it if you already work in IT) and then Solutions Architect Associate. AWS lists at least one year of hands-on design experience as the intended background for SAA-C03, so your portfolio projects need to stand in for that experience. The AWS Solutions Architect Associate certification guidebreaks down the exam domains, and if you want structured preparation, Simpliaxis's AWS Solutions Architect Associate (SAA-C03) course follows the same domains.

On Azure, the usual order is AZ-900 and then AZ-104. Microsoft expects AZ-104 candidates to know PowerShell, the Azure CLI, Bicep and Microsoft Entra ID, so practise all of them rather than just the portal. The Microsoft Azure certification pathshows what comes after AZ-104.

Hold the add-ons until you have a job offer or 6 months of cloud work behind you. Terraform Associate is a cheap signal that you know IaC, and CKA makes sense once your team runs Kubernetes.

So which cloud should you pick? It depends on who you want to work for. Enterprises already invested in Microsoft 365 and Active Directory often lean Azure, while many startups build on AWS. Read 30 postings in your target city before you decide, because that sample will tell you more than any blog, this one included.

Cloud Engineer Projects for Your Portfolio

Recruiters skim CVs fast, and a GitHub link with working projects is what makes them slow down. Each project below maps to a question that comes up regularly in junior cloud interviews.

Project 1: Highly Available Web Application with Terraform

A containerised web app behind a load balancer across two Availability Zones, with a private managed database, all in Terraform.

Focus: Network design and repeatable provisioning.

Deliverables:

• A Terraform repository with modules for network, compute and database.
• An architecture diagram and a README with plan output.

Skills practised: VPC design, IaC, load balancing, high availability.

Project 2: Serverless File Processing Pipeline

An image upload triggers a function that resizes the image and stores its metadata. Use AWS Lambda with S3 and DynamoDB, or Azure Functions with Blob Storage and Cosmos DB.

Focus: Event-driven design and IAM scoped to exactly one bucket and one table.

Deliverables:

• Function code with unit tests.
• IaC for every resource.
• A monthly cost estimate at 10,000 uploads.

Skills practised: Serverless, event triggers, least privilege, cost estimation.

Project 3: Kubernetes Deployment with a Full CI/CD Pipeline

Deploy a two-service app with Helm to EKS, AKS or a local kind cluster, and add a GitHub Actions workflow that builds, scans and deploys on every merge.

Focus: Container delivery and safe rollouts.

Deliverables:

• Dockerfiles, Helm chart and workflow file.
• A demo of a rolling update and a rollback.

Skills practised: Docker, Kubernetes, Helm, CI/CD.

Project 4: Cloud Cost and Security Audit Script

A Python script that reports untagged resources, unattached volumes, public buckets, port 22 open to 0.0.0.0/0, and IAM users without MFA.

Focus: Operational hygiene.

Deliverables:

• The script, packaged with a requirements file.
• A sample report in CSV or Markdown.

Skills practised: SDKs, security basics, cost awareness, automation.

How to Become a Cloud Engineer as a Fresher vs a Career Switcher?

Where you start decides which months of the roadmap you can skip.

Cloud Engineer for Freshers

As a fresher, you have no production exposure, so your projects carry more weight than they would for someone with a job history. Follow all nine months and apply for titles such as cloud support associate, junior cloud engineer or cloud operations engineer. Support roles at managed service companies are worth a serious look, because they put you in front of real incidents early.

Career Switchers: Where You Already Have a Head Start

Windows and Active Directory admins often find Azure familiar territory. If that describes you, AZ-104 maps closely to the administration work you already do, which makes it a sensible first associate exam.

Cloud Engineer Salary and Job Outlook

How much a cloud engineer makes depends on country, city, platform and experience, and most published figures are self-reported, so treat any single number with caution.

The US Bureau of Labor Statistics doesn't track "cloud engineer" as its own occupation. Its closest match, computer network architects, had a median pay of $134,050 per year in 2025, with employment projected to grow 8 percent from 2025 to 2035. BLS notes that continued expansion of cloud computing will increase demand for these workers. Use that figure as a reference for senior design roles rather than entry-level pay.

India has no government equivalent of the BLS series for this role. Salary aggregators report quite different numbers, since each one relies on self-reported data from its own users. Before you negotiate, compare two or three named sources such as AmbitionBox, Naukri and Glassdoor for your city and experience band, and trust figures with a large, recent sample more than the rest.

Cloud engineer jobs are posted under many titles, so widen your search to cloud operations, platform engineer and cloud support engineer as well.

Common Mistakes Aspiring Cloud Engineers Make

• Collecting certifications without building. Three badges and an empty GitHub profile look like exam preparation to a hiring manager, and they'll ask about projects anyway.
• Skipping networking. Most "my app cannot connect" problems turn out to be routing, security groups or DNS.
• Building only in the console. Teams deploy through code, so rebuild every project in Terraform.
• Ignoring the bill. Set a budget alert on day one. A forgotten NAT gateway or GPU instance adds up fast.

Conclusion

Becoming a cloud engineer comes down to a sequence: Linux and networking, one cloud in depth, infrastructure as code, containers and pipelines, then security and cost. Certifications are checkpoints; projects are the proof. Six to nine months of steady practice puts you in contention for junior roles.

If you're starting from scratch on AWS and want a structured first step, Simpliaxis's AWS Cloud Practitioner certification training covers the fundamentals before you move on to an associate exam. If your target employers are Microsoft-heavy, go from AZ-900 to AZ-104 instead.