Cloud Engineer

Cloud Engineer carries out essential functions and this page lists 20 real tasks to illustrate what success looks like. Each task reveals who you coordinate with and what evidence guides choices. Each one shows where we found it, and comes with an AI prompt you can copy and use straight away.

20evidenced tasks
20ready prompts
8tools of the trade
15-1299.05O*NET-SOC code
435,370hold this job (US, BLS 2025)
$116,580median pay/yr (US)
Open Cloud Engineer in the interactive atlas →

What it pays

Government survey numbers — not estimates, not ads.

Half of all Computer Occupations, All Other in the U.S. earn more than $116,580 a year — the middle 80% land between $55,940 and $188,470. About 435,370 people in the U.S. do this work. Figures are for the U.S. occupation group “Computer Occupations, All Other”. (U.S. Bureau of Labor Statistics survey, published 2025.) In India, Professionals earn about ₹38,298 a month on average — around ₹4.6 lakh a year (government PLFS survey via ILOSTAT, occupation-family figure).
$116,580typical pay / year
435,370people in this work
$188,470+top 10% earn
₹4.6 lakha year in India (family avg)
Think you get this job?Six quick questions on how it really works — with a hint and the reason behind every answer.
Test yourself →

The work, task by task

These are the real jobs-to-be-done, not a wish list. Each task shows where we found it, and the prompt underneath is written for that exact task.

Protecting4

Configure firewalls, SIEM, IDS/IPS

+
Configure perimeter and host firewalls, deploy the SIEM ingestion rules, and enable IDS/IPS sensors across…
Configure perimeter and host firewalls, deploy the SIEM ingestion rules, and enable IDS/IPS sensors across prod and DR networks so logging forwards to the security team, verifying rule sets match the ICT spec and documenting changes in the audit log by Friday.
The tools that do the workAnsiblejob descriptionsO*NET

Identify security weaknesses

+
Perform an automated and manual review of the environment to identify misconfigurations, weak IAM policies…
Perform an automated and manual review of the environment to identify misconfigurations, weak IAM policies and exposed services, produce a ranked risk register with evidence and remediation steps, and brief the security manager on Monday.
The tools that do the workBashjob descriptionsO*NET

Implement and manage security controls

+
Roll out the approved security control baseline to all environments, enforce hardened images and config,…
Roll out the approved security control baseline to all environments, enforce hardened images and config, enable continuous compliance checks, and record control owners and exceptions in the audit trail before the quarter-end review.
The tools that do the workChefjob descriptionsO*NET

Implement solutions to control access to data and programs

+
Implement role-based access and least-privilege policies for applications and data stores, create and test…
Implement role-based access and least-privilege policies for applications and data stores, create and test automated account provisioning and deprovisioning workflows, and validate access controls against the ICT specification with a signed checklist.
The tools that do the workAmazon Web Services AWSESCOO*NET
The daily work16

Review security assessments for computing environments or check for compliance with cybersecurity standards and regulations.

+
Review the latest security assessment report for production and staging compute environments, confirm…
Review the latest security assessment report for production and staging compute environments, confirm controls map to ISO 27001 clauses and our network diagram, flag nonconformities with evidence, estimate risk severity, and add results to the audit log by Friday.
The tools that do the workAmazon Web Services AWSO*NET

Collaborate with IT and development teams

+
Schedule a 60-minute working session with the platform, application, and QA leads to walk through the…
Schedule a 60-minute working session with the platform, application, and QA leads to walk through the security requirements in the deployment spec, capture agreed action items, assign owners, and post the minutes to the team record before the sprint planning meeting.
The tools that do the workAtlassian JIRAAtlassian Confluencejob descriptions

Stay updated with security trends and vulnerabilities

+
Scan this morning's vulnerability feeds and vendor advisories for high and critical items affecting our…
Scan this morning's vulnerability feeds and vendor advisories for high and critical items affecting our runtime stack, summarize impacted components and required mitigations, recommend patch windows, and email the executive security digest by noon.
The tools that do the workBashjob descriptions

Analyze security alerts and logs

+
Triage the overnight security alerts for anomalies in authentication and outbound traffic, correlate alerts…
Triage the overnight security alerts for anomalies in authentication and outbound traffic, correlate alerts with recent deployments, list confirmed incidents and false positives, escalate incidents to incident response with timestamps, and append findings to the incident log.
The tools that do the workAmazon Web Services AWSjob descriptions

Manage encryption solutions and protocols

+
Review current key management policies and the live encryption configuration for storage and transit,…
Review current key management policies and the live encryption configuration for storage and transit, validate algorithm choices and rotation schedules against NIST guidance, draft required configuration changes, and set a rollout plan with rollback steps.
The tools that do the workChefjob descriptions

Ensure compliance with industry standards

+
Run a compliance check against PCI and SOC 2 control mappings for our cloud services, list remaining evidence…
Run a compliance check against PCI and SOC 2 control mappings for our cloud services, list remaining evidence items and remediation tasks, assign owners with deadlines, and produce a one-page status for the compliance manager ahead of the audit window.
The tools that do the workAnsiblejob descriptions

Educate on data confidentiality

+
Run a one-hour team session for Platform Engineers this Thursday explaining our data classification rules,…
Run a one-hour team session for Platform Engineers this Thursday explaining our data classification rules, how encrypted backups and key rotation protect customer PII, and give two short exercises showing what not to store in logs; draft the slide deck and attendee list first.
The tools that do the workAtlassian ConfluenceESCOsee the evidence ↗

Verify formal ICT specifications

+
Compare the current network design and storage encryption sections in the project specification against the…
Compare the current network design and storage encryption sections in the project specification against the company's security baseline, flag any deviations with risk ratings and required acceptance from the information security manager, and attach the annotated spec to the project folder.
The tools that do the workAmazon Web Services AWSAtlassian ConfluenceESCOsee the evidence ↗

Execute ICT audits

+
Run a systems audit of the production accounts this Friday: collect IAM role usage, S3 bucket policies, VPC…
Run a systems audit of the production accounts this Friday: collect IAM role usage, S3 bucket policies, VPC flow logs and encryption-at-rest settings, score findings against our audit checklist, and produce a remediation plan with owners and two-week deadlines.
The tools that do the workBashESCOsee the evidence ↗

Keep task records

+
Update the team task log with this week's work: list tickets closed, changes deployed, postmortems started,…
Update the team task log with this week's work: list tickets closed, changes deployed, postmortems started, and outstanding risks; include links to configuration commits, the audit report, and the next actions for Monday's stand-up.
The tools that do the workAtlassian JIRAESCOsee the evidence ↗

Support secure system architecture design

+
Design a secure architecture for the new customer-data service: map data flows, document encryption and key…
Design a secure architecture for the new customer-data service: map data flows, document encryption and key management decisions, list trust boundaries and residual risks, and produce a one-page briefing for Legal and Ops before Tuesday noon.
The tools that do the workAmazon Web Services AWSjob descriptions

Perform patch management and updates

+
Roll out the critical OS and agent patches to production fleet staggered by region, verify post-patch health…
Roll out the critical OS and agent patches to production fleet staggered by region, verify post-patch health checks, record versions and rollback plan in the change log, and notify Support and the security team by end of Friday.
The tools that do the workAnsiblejob descriptions

Explain technical issues to non-technical teams

+
Prepare a plain-language one-page explainer and 10-minute slide deck that describes last week's outage root…
Prepare a plain-language one-page explainer and 10-minute slide deck that describes last week's outage root cause, impact on customer data, and the mitigation steps we took, then present to Product and Customer Success on Wednesday.
The tools that do the workAtlassian ConfluenceAtlassian JIRAjob descriptions

Advise ICT security solutions

+
Advise on hardening the web tier: recommend firewall rules, multi-factor access, WAF tuning, and key…
Advise on hardening the web tier: recommend firewall rules, multi-factor access, WAF tuning, and key monitoring metrics, provide a risk-ranked implementation plan and estimated effort for the CTO by Friday afternoon.
The tools that do the workBorder Gateway Protocol BGPESCO

Promote safe exchange of information

+
Set up an encrypted file-exchange process for partners: define allowed file types, transport encryption,…
Set up an encrypted file-exchange process for partners: define allowed file types, transport encryption, retention periods, and verification steps, draft partner instructions and a confidentiality note for Legal by next Tuesday.
The tools that do the workAmazon Web Services AWS CloudFormationESCO

Implement solutions to control access

+
Implement role-based access controls for the ops cluster: map current accounts to roles, remove unused…
Implement role-based access controls for the ops cluster: map current accounts to roles, remove unused privileges, document approval workflow, and stage the changes in the staging environment for review on Thursday.
The tools that do the workChefESCO

Says who?

These are the pages we read to build this. Open any of them and check us.

The logs, files & records this job keeps

Shared with other careers — the same record means something different in each.

Related careers

Same family of work — each with its own tasks and prompts.

The LLOS Work Atlas is the world's largest evidenced task library — a map of human work, with a ready prompt behind every task. 1,774 careers · every task named by the sources that witnessed it — O*NET, ESCO, real job descriptions, Wikipedia — and the deepest tasks by several at once. And it is honest about limits: where AI cannot help, the map says so.

The rest of the map

Same library, five ways in.

Copyright © LLOS.ai · 2026 — original pedagogy, voice, and design — all rights reserved.
Built on public evidence: O*NET®, ESCO, Wikipedia, U.S. Bureau of Labor Statistics, ILOSTAT. All sources & licenses