Cloud security hiring
Hire cloud security engineers who can read an IAM policy.
Cloud certifications get you a shortlist. They do not tell you who can spot the one line in a Terraform module that hands an attacker a path to admin. Put candidates in front of real infrastructure code and identity logs, and see what they find.
AWS and GCP Terraform · Identity logs · Built from your job spec
Trusted by cyber security teams at
At a glance
What is a cloud security engineer assessment?
A cloud security engineer assessment is a hands-on review of the places cloud risk actually lives: infrastructure code, identity and access policies, sign-in logs and cloud incidents. Candidates find the misconfigurations and escalation paths and say what they reach, before anyone is interviewed.
- Work
- AWS and GCP Terraform, AWS IAM policies, Dockerfiles, Azure AD sign-in logs, cloud incident cases
- Environments
- Code review in the browser, Event Viewer with Azure AD sign-in and audit logs, KQL workspace, incident documents
- Level
- Junior, mid-level or senior. Tell us the level and we build it to that difficulty.
- Length
- Sized to your process. The ready-made assessment is six challenges, under two hours; a first screen needs two or three.
- Scoring
- Automatic, against the same answer key for every candidate, broken down by skill.
- Integrity
- Three modes, up to webcam proctoring with consent. Signals sit next to every score.
- Delivery
- A link, a secure bulk upload or straight from your ATS, in your branding.
Why hiring managers use it
See who spots the misconfiguration before it ships.
A cloud certification checks that someone knows what each service does. Securing an account is about how identities, policies and resources combine, and that is where the real mistakes hide.
-
Infrastructure code, reviewed for real.
Terraform modules and IAM policies written with the kinds of mistakes that reach production. Candidates find what is wrong, including grants that look narrow and are not.
-
Identity, where cloud breaches start.
Candidates hunt through Azure AD sign-in logs and KQL, separating the attacker's session from legitimate travel and VPN use.
-
Incidents worked through.
A compromised root key and an abused role ask candidates to work out the blast radius and what to do next, which is where cloud judgement shows.
-
Built from your job spec.
Send the spec and we build the assessment around it, weighted to infrastructure code, identity or incident work to match the role. Your engineers write nothing and mark nothing.
What candidates work on
The ready-made cloud security assessment.
Six hands-on challenges across infrastructure code, identity and cloud incidents, set at mid-level. We tailor it to your job spec, from the challenges to the length and level.
Infrastructure as code
- Code Review: Dockerfile Security
- Code Review: Terraform IAM Misconfiguration
- Terraform Security Review: AWS Infrastructure
Identity
- Cloud Sign-In Hunt - Impossible Travel + Risky Sign-Ins
Cloud incidents
- Cloud IR - AssumeRole Abuse Investigation
- AWS Root Key Compromise - Blast Radius Investigation
6 challenges · about 112 minutes as listed · trim or swap any of them for your role
One case, end to end
What a strong answer actually looks like.
A Terraform configuration for a GCP project contains an IAM privilege escalation path, long-lived service account keys and an over-permissive bucket grant. Find the issues that matter and explain what the escalation actually reaches.
Picks out the grant that looks narrow on its face, follows the chain through to the access it actually reaches across the project, and ranks it against the issues that are real but smaller.
Lists the obvious problems from the brief and stops, without following the escalation path to what an attacker would end up holding.
The candidate's screen
Identity logs, with the travellers left in.
Most sign-ins from unusual places are legitimate. The work is finding the one that is not.
Free, before you commit to anything
See it before a candidate does.
Tell us the role. We build a hands-on cloud security engineer assessment for it, in your branding, and send you a private link to sit it yourself. If it is not right for your team, you have lost nothing.
- 01 Tell us the role Send the job spec or just the role title. A job description helps but is not required.
- 02 We build it for you We turn the spec into a hands-on cloud security engineer assessment from real challenges, at the right level, in your branding.
- 03 Invite your applicants You get a private link to try it first. When you are happy, send it to your applicants. That is it.
What you get back
Evidence for every candidate. Read in two minutes.
Results arrive in your workspace as candidates finish, and as a hiring report you can forward to anyone on the panel, including people who never log in. Connected to your ATS, the result is written back to the candidate record.
- Ranked, scored the same way Every candidate on the same challenges and the same answer key, ranked on what they did.
- A score per skill Where each candidate is strong and where they are thin, with their actual answers underneath.
- What to probe at interview For every candidate: the skills they were weakest on and the questions behind it.
- Integrity next to every score Time away, outside pasting, fullscreen exits and second screens, flagged for you to weigh.
How it runs
From job spec to evidence you can act on.
- 01
Send us the role
Fill in the form with the job spec, or just the role title. That is all we need from you.
- 02
We build your assessment
Hands-on, built to your role and level, in your branding, and ready to send. Change anything you like, or send it exactly as it is.
- 03
Invite candidates
A link, a secure bulk upload or straight from your ATS. Everyone reviews the same code and logs.
- 04
Candidates do the work
In a code viewer and real log tools, in your branding, with integrity monitoring on.
- 05
Read the evidence
A ranked cohort, a score per skill, the questions to probe with each candidate and any integrity signals.
Questions we get asked
Cloud security hiring questions, answered.
How do you assess a cloud security engineer before interview?
Give them real infrastructure code and policies to review, identity logs to hunt through and a cloud incident to work. Score what they find and how they justify it, then use the interview for architecture and trade-offs.
Which clouds does it cover?
Hands-on infrastructure review covers AWS and GCP Terraform and AWS IAM policies. Identity hunting runs on Azure AD sign-in and audit logs. We build the assessment from your job specification, weighted to the areas the role owns.
Is it multiple choice?
Some questions are, where the point is choosing between plausible findings. The core of each challenge is real code or real logs, and many answers are typed from what the candidate found, so there is nothing to recognise from a list.
Do we still need to interview?
Yes. The assessment shows who can spot the misconfiguration and the suspicious session. The interview then covers design decisions, how they work with platform teams and the areas the assessment flagged.
Go deeper
How we think about cloud security assessment
None of it is gated.
Try it on your role
See the cloud security assessment built for your role.
Send us the job spec. We build the assessment around it, in your branding, and you try it yourself first. Free, and with no commitment.