Career Roadmap
AWS Security Engineer: Zero to Hero
This roadmap guides you from AWS operations to professional security engineering on AWS. You will secure AWS workloads across identity, detection, incident response, infrastructure, data protection, and governance. SAA-C03 builds the operational foundation. SCS-C03 validates AWS security expertise. The exam reflects the December 2025 update with IAM now the heaviest domain at 20%, generative AI security added, and new question formats. Use ExamOS practice quizzes to track progress at every stage.
Who is this roadmap for?
This roadmap is designed for Cloud Engineers working on AWS who want to specialize in security, as well as Security Analysts transitioning into cloud security who need operational AWS depth. Additionally, it is tailored for DevOps Engineers embedding security into pipelines, as well as Solutions Architects designing secure systems who require hands-on credential validation.
Skills You'll Develop
Design and operate AWS infrastructure with SAA-C03-level depth across networking, compute, storage, and databases.
Design least-privilege IAM architectures, write complex policies, implement cross-account access, and use IAM Access Analyzer.
Deploy GuardDuty, Security Hub, and Macie; build automated response workflows; and lead incident response in AWS.
Architect VPC security, configure WAF and Shield, secure EC2 and EKS, and implement Network Firewall.
Implement KMS, encryption at rest and in transit, Secrets Manager, and certificate management.
Enforce organizational policies with Organizations, Control Tower, Config, and Resource Control Policies (RCPs).
Target Roles in this Roadmap
- AWS Security Engineer: Designs and implements security controls across AWS workloads
- Cloud Security Architect: Designs secure AWS architectures and governance frameworks
- DevSecOps Engineer: Embeds security into CI/CD pipelines and infrastructure automation
- Security Operations Engineer: Builds threat detection, incident response, and automated remediation on AWS
- AWS Security Consultant: Advises organizations on AWS security best practices and compliance
Typical Employer Categories
- Technology & Software Firms: SaaS platforms, cloud-native companies, enterprise software vendors on AWS
- Financial Services: Banking, fintech, payment processors, and trading platforms running on AWS
- Healthcare Organizations: Patient data platforms, HIPAA-compliant workloads on AWS
- Government & Defense: Federal agencies, defense contractors, public sector AWS migrations
- Consulting & Professional Services: AWS security assessments, transformation engagements, managed security providers
- AWS Partners: AWS Managed Service Providers (MSPs), AWS Competency Partners, and security consultancies
The Certification Path
Recommended Path
| Cert | When | Why |
|---|---|---|
| AWS SAA-C03 (Solutions Architect Associate) | Month 2-4 | Operational AWS foundation. Required for effective security work in AWS environments. |
| AWS SCS-C03 (Security Specialty) | Month 8-14 | The core AWS security credential. Updated December 2025 with IAM at 20%, generative AI security, and new question formats. |
Optional Foundation
| Cert | When | Why |
|---|---|---|
| AWS CLF-C02 (Cloud Practitioner) | Month 1 | Optional warm-up. Only needed if you are completely new to AWS and cloud concepts. |
Specialization Path
| Cert | When | Why |
|---|---|---|
| AWS SAP-C02 (Solutions Architect Professional) | Month 14-18 | Senior architecture credential. Adds architectural depth to security expertise. |
| AWS DOP-C02 (DevOps Engineer Professional) | Month 14-18 | DevSecOps depth for security engineers working in pipeline-heavy environments. |
| ISC2 CCSP | Month 16-20 | Cross-platform senior cloud security credential. Adds governance and compliance depth. |
Milestones: Junior → Mid → Senior
| Level | Milestone | When |
|---|---|---|
| Entry Level | SAA-C03 + basic AWS security understanding | Month 4-5 |
| Practitioner Level | SCS-C03 + AWS security proficiency | Month 12-14 |
| Specialist Level | SCS-C03 + SAP-C02 or DOP-C02 + enterprise security architecture skills | Month 16+ |
Step 0 - AWS operations and security foundations
Build operational AWS knowledge and security foundations. SAA-C03 is the recommended prerequisite for SCS-C03 and is non-negotiable for effective security work in AWS environments.
~3-4 months~3-4 months
Step 0 - AWS operations and security foundations
Build operational AWS knowledge and security foundations. SAA-C03 is the recommended prerequisite for SCS-C03 and is non-negotiable for effective security work in AWS environments.
- AWS resource hierarchy: Organizations, OUs, accounts, and IAM
- AWS networking: VPCs, subnets, security groups, NACLs, VPC peering, Transit Gateway, Route 53
- AWS compute: EC2, Lambda, ECS, EKS basics
- AWS storage: S3, EBS, EFS, lifecycle policies, encryption options
- AWS databases: RDS, DynamoDB, Aurora
- IAM fundamentals: users, groups, roles, policies, instance profiles, policy evaluation logic
- AWS CloudTrail and CloudWatch: logging, metrics, alarms, and event patterns
- Security fundamentals: authentication vs authorization, CIA triad, least privilege, defense in depth
- Networking fundamentals: TCP/IP, DNS, TLS, subnets, routing, and common attack vectors
- Identity concepts: federated identity, SSO, MFA, OIDC, SAML
Certifications
💡 SAA-C03 is the recommended prerequisite for SCS-C03. Candidates without SAA-C03-level AWS knowledge consistently struggle with the infrastructure security and IAM domains.
💡 CLF-C02 (AWS Cloud Practitioner) is optional. If you are completely new to AWS, take it as a warm-up. If you already have any AWS experience, skip it and go straight to SAA-C03.
💡 IAM is the foundation of AWS security. Invest extra time here—IAM policy evaluation logic appears in every domain of SCS-C03.
🏁 Entry Level Checkpoint: You have passed SAA-C03. You can reason through AWS networking, IAM, and compute scenarios confidently.
🛠 Project Ideas
- ▸Deploy a VPC with public and private subnets, an internet gateway, a NAT gateway, and a bastion host. Configure security groups and NACLs to enforce least-privilege access.
- ▸Write an IAM policy that enforces least-privilege access for a specific application role. Test it by attempting actions that should be denied.
- ▸Enable CloudTrail and CloudWatch for a test environment. Create an alarm that triggers when a specific API call is made.
Step 1 - AWS security engineering (SCS-C03)
Secure AWS workloads across identity, detection, incident response, infrastructure, data protection, and governance. SCS-C03 replaced SCS-C02 on December 2, 2025, with IAM now the heaviest domain at 20%.
~4-6 months~4-6 months
Step 1 - AWS security engineering (SCS-C03)
Secure AWS workloads across identity, detection, incident response, infrastructure, data protection, and governance. SCS-C03 replaced SCS-C02 on December 2, 2025, with IAM now the heaviest domain at 20%.
- Identity and Access Management (20%): IAM policy evaluation logic, resource-based policies, permissions boundaries, SCPs, RCPs, cross-account access, IAM Access Analyzer, identity federation
- Detection (16%): GuardDuty (Extended Threat Detection, Malware Protection), Security Hub (CSPM, attack path analysis), CloudTrail, CloudWatch, Macie, Amazon Security Lake
- Incident Response (14%): response plans, forensics, automated remediation, containment strategies, incident simulation
- Infrastructure Security (18%): VPC security, security groups, NACLs, AWS WAF, Shield, Network Firewall, EC2 security, EKS security
- Data Protection (18%): KMS (key management, envelope encryption), S3 encryption, RDS encryption, certificate management (ACM), Secrets Manager
- Security Foundations and Governance (14%): AWS Organizations, Control Tower, Config, Systems Manager, Resource Control Policies (RCPs)
- Generative AI and ML Security: Amazon Bedrock security, guardrails for generative AI, model training data protection, GuardDuty detection for AI/ML activities
Certifications
💡 IAM is the single heaviest domain at 20%. Misconfigured IAM policies, overly permissive roles, and confused-deputy vulnerabilities cause more breaches than network misconfigurations. Deep IAM understanding is non-negotiable.
💡 GuardDuty Extended Threat Detection and Security Hub CSPM/attack path analysis are new in SCS-C03. Know how these services work together for threat detection and posture management.
💡 SCS-C03 introduces ordering (arrange 3-5 steps in correct sequence) and matching (match items from two lists) question formats alongside traditional multiple-choice and multiple-response.
💡 Generative AI security is now explicitly in scope. Understand Bedrock security, guardrails, and the shared responsibility model for AI workloads.
🏁 Practitioner Level Checkpoint: You have passed SCS-C03. You can secure AWS workloads across identity, detection, incident response, infrastructure, data protection, and governance.
🛠 Project Ideas
- ▸Configure KMS with a customer-managed key (CMEK) for an S3 bucket. Implement a key rotation policy and verify encryption at rest.
- ▸Write a Service Control Policy (SCP) that enforces encryption at rest across all resources in an AWS Organization.
Step 2 - Exam consolidation and follow-on paths
Consolidate SCS-C03 preparation through integrated scenario practice, timed simulations, and targeted gap closure before booking your exam. Identify follow-on credentials that extend your AWS security capability.
~1 month~1 month
Step 2 - Exam consolidation and follow-on paths
Consolidate SCS-C03 preparation through integrated scenario practice, timed simulations, and targeted gap closure before booking your exam. Identify follow-on credentials that extend your AWS security capability.
- Full-domain scenario practice across all SCS-C03 domains (IAM, Detection, Incident Response, Infrastructure Security, Data Protection, Governance)
- Timed simulations for SCS-C03 (65 questions, 170 minutes)
- Practice with ordering and matching question formats—these are new in SCS-C03 and require different preparation
- Official AWS practice exam and domain-weighted review
- Follow-on paths: SAP-C02 (Solutions Architect Professional) for architectural depth, DOP-C02 (DevOps Engineer Professional) for DevSecOps, CCSP for cross-platform governance
Certifications
💡 Consistent performance above 80% on Legend mode across five consecutive ExamOS sessions is the clearest readiness signal for SCS-C03.
💡 The most common AWS security failure pattern is knowing what services exist without being able to reason through which is correct for a described scenario with multiple plausible alternatives.
💡 SAP-C02 (Solutions Architect Professional) is the natural senior follow-on for security engineers moving into architecture roles.
💡 DOP-C02 (DevOps Engineer Professional) is the natural follow-on for security engineers working in pipeline-heavy or DevSecOps environments.
🏁 Specialist Level Checkpoint: You have passed your target certifications. You can design, secure, and operate AWS environments at an enterprise level.
Final Step - What this path actually builds
This roadmap moves you from operational AWS knowledge to professional security engineering. SAA-C03 validates that you understand AWS infrastructure. SCS-C03 validates that you can secure it. IAM is now the heaviest domain at 20%—the credential recognizes that most cloud breaches originate from identity misconfiguration, not network flaws. The updated exam adds generative AI security and new question formats. The security engineer who completes this path can design least-privilege IAM architectures, detect threats at scale, respond to incidents, protect data, and enforce governance across AWS Organizations. SAP-C02 and DOP-C02 are natural follow-ons for architects and DevSecOps engineers respectively. Build real security controls. Measure your readiness with ExamOS. Book when your reasoning is sharp and your IAM policies are correct.
Final Step - What this path actually builds
This roadmap moves you from operational AWS knowledge to professional security engineering. SAA-C03 validates that you understand AWS infrastructure. SCS-C03 validates that you can secure it. IAM is now the heaviest domain at 20%—the credential recognizes that most cloud breaches originate from identity misconfiguration, not network flaws. The updated exam adds generative AI security and new question formats. The security engineer who completes this path can design least-privilege IAM architectures, detect threats at scale, respond to incidents, protect data, and enforce governance across AWS Organizations. SAP-C02 and DOP-C02 are natural follow-ons for architects and DevSecOps engineers respectively. Build real security controls. Measure your readiness with ExamOS. Book when your reasoning is sharp and your IAM policies are correct.
Certifications
Final Thoughts
💡 Total: 10-16 months at 2 hours/day (8-12 months at 3-4 hours/day)
💡 CLF-C02: Adds 2-3 weeks for complete beginners (optional).
💡 SAA-C03: Typically takes 6-10 weeks for candidates with general IT experience.
💡 SCS-C03: Typically takes 10-16 weeks for candidates with SAA-C03 knowledge.
💡 IAM is now the heaviest domain at 20% — allocate proportionally more study time to IAM.
💡 Practice ordering and matching question formats — they are new in SCS-C03 and require different preparation.
💡 Readiness: Consistent 80%+ on Legend mode across five sessions is your signal to book.
Honest Timeline
| Path | Minimum Study Pace | More Realistic Pace |
|---|---|---|
| CLF-C02 only (optional) | ~2 weeks | ~1 month |
| SAA-C03 only | ~2 months | ~3 months |
| SAA-C03 + SCS-C03 | ~6 months | ~10 months |
| SAA-C03 + SCS-C03 + SAP-C02/DOP-C02 | ~10 months | ~16 months |