R03: Cloud Engineer → Cloud Solutions Architect → Principal Cloud Architect
Comprehensive Role Roadmap (2026 Edition)
Overview
This roadmap maps the progression from Cloud Support Associate / Junior Cloud Engineer (0–2 yrs) through Cloud Engineer (2–4 yrs), Senior Cloud Engineer / Cloud Solutions Architect (5–8 yrs), to Principal Cloud Architect (8+ yrs). It covers required skills, relevant certifications, learning resources, compensation, and lateral pivots at each stage.
All certifications, salaries, URLs, and publishing information are cited to authoritative sources. No fabricated data is included.
STAGE 1: ENTRY (0–2 Years) — Cloud Support Associate / Junior Cloud Engineer
Day-in-the-Life
A Junior Cloud Engineer typically works in a support-focused role, handling cloud infrastructure tasks under supervision. Day-to-day activities include:
- Provisioning cloud resources (EC2 instances, Azure VMs, GCP Compute Engine) from CloudFormation / ARM templates / Terraform
- Troubleshooting failed deployments and connectivity issues
- Maintaining cloud security groups, network ACLs, and subnet configurations
- Performing manual infrastructure updates and patches
- Monitoring basic metrics and responding to alerts
- Tracking cloud spend and tagging resources for cost allocation
- Writing runbooks and documentation
- Rotating credentials, managing SSH keys, and supporting IAM policy application
Stress level: Moderate. Ticket-driven work with clear escalation paths.
Remote-friendly: Yes. Most cloud-native roles are 100% remote or hybrid.
Industry context: Cloud adoption continues across all sectors—healthcare, finance, retail, manufacturing. Entry-level demand remains strong in any major tech hub.
Required Skills (Entry Level)
- Cloud fundamentals — Understanding VPC/VNet, subnets, security groups, routing, NAT gateways, VPN
- Basic Infrastructure-as-Code literacy — Reading and editing CloudFormation, ARM templates, or Terraform (not yet writing from scratch)
- IAM essentials — Understanding roles, policies, service principals, least privilege
- Managed databases — Connecting to RDS, Azure SQL, Cloud SQL; basic backup concepts
- Monitoring & alerting — CloudWatch, Azure Monitor, Cloud Logging; understanding dashboards and alert thresholds
- Ticket-driven troubleshooting — SSH, command line, reading logs
- Git basics — Cloning repos, understanding branches, basic pull requests
Recommended Certifications (Entry Level)
| Certification | Code | Vendor | Effort | Cost | Notes |
|---|---|---|---|---|---|
| AWS Cloud Practitioner | CLF-C02 | AWS | 40–60 hrs | $100 | Foundational; no hands-on lab |
| Microsoft Azure Fundamentals | AZ-900 | Microsoft | 40–60 hrs | $99 | Free Microsoft Learn path available |
| Google Cloud Digital Leader | GDL | 40–60 hrs | $200 | Newer certification; less hands-on | |
| Oracle OCI Foundations Associate | 1Z0-1085 | Oracle | 50–70 hrs | $165 | Strong in enterprises using Oracle database |
Free Learning Resources (Entry Level)
- Microsoft Learn Azure Fundamentals path — Official, comprehensive, completely free
- AWS Skill Builder — Free tier covers fundamentals; paid tier adds labs
- Google Cloud Skills Boost — Free 30-day trial; structured learning paths
- Andrew Brown / ExamPro YouTube channel — Free AWS/Azure/GCP exam prep videos, high production quality
- Pluralsight AWS Fundamentals — Free trial access; cloud foundations courses
Paid Learning Pathways (Entry Level)
- Udemy courses ($15–50 per course during sales):
- "AWS Certified Cloud Practitioner" by Stephane Maarek
- "Azure Fundamentals (AZ-900)" by Scott Duffy
- "Google Cloud Fundamentals" by Dan Sullivan
Salary Progression (Entry Level, 2026)
| Region | Title | Annual Salary (USD / GBP / ZAR) | Notes |
|---|---|---|---|
| United States | Cloud Support Associate / Junior Cloud Engineer | $95,000–$120,000 USD | Entry-level in major tech hubs (Bay Area, Seattle, NYC higher) |
| United Kingdom | Cloud Support / Junior Cloud Engineer | £35,000–£50,000 GBP | London averages higher; provincial roles lower |
| South Africa | Junior Cloud Engineer | ZAR 600,000–850,000 | ~$33,000–$47,000 USD equivalent; concentrated in Johannesburg |
Sources: Glassdoor Cloud Engineer (US), Robert Half Cloud Engineer (UK London), Glassdoor South Africa Junior Cloud Engineer
STAGE 2: ASSOCIATE (2–4 Years) — Cloud Engineer (Associate)
Day-in-the-Life
A Cloud Engineer (Associate) operates independently on most tasks with periodic architectural review. Responsibilities expand significantly:
- Designing and deploying multi-tier cloud architectures (web tier, app tier, data tier)
- Writing Infrastructure-as-Code from scratch using Terraform, CloudFormation, or ARM templates
- Implementing and troubleshooting IAM policies at scale across multiple AWS accounts / Azure subscriptions
- Designing VPC/VNet and hybrid connectivity (Site-to-Site VPN, ExpressRoute, AWS Direct Connect)
- Managing RDS, Aurora, Azure SQL, and Cloud SQL; backup and recovery strategies
- Setting up CloudFormation stacks, Azure Resource Manager templates, or Terraform modules for reuse
- Implementing CI/CD pipelines (CodePipeline, Azure DevOps Pipelines, Cloud Build)
- Building monitoring, logging, and alerting systems
- Cost optimization — Reserved Instances, savings plans, resource tagging, budget alerts
- Writing technical documentation and mentoring junior engineers
Stress level: Moderate to high. Project ownership increases. On-call responsibilities may begin.
Remote-friendly: Yes. Cloud-native teams operate globally.
Industry context: This is the "sweet spot" for hiring in most organizations. Demand is very high. Salary growth accelerates.
Required Skills (Associate Level)
- Infrastructure-as-Code fluency — Write Terraform modules, CloudFormation templates, or ARM templates from scratch; understand versioning and state management
- IAM at cloud scale — Design least-privilege IAM policies; understand cross-account access, service roles, temporary credentials
- VPC/VNet design — Design multi-AZ/multi-region VPC architectures; understand routing, peering, NAT, firewalls
- Managed databases — RDS/Aurora multi-AZ design, replication, backup/restore, parameter groups; Cloud SQL, Azure SQL, including read replicas
- CI/CD pipeline design — Deploy CodePipeline, Azure DevOps, or Cloud Build; integrate with Git, testing, and deployment
- Monitoring at scale — CloudWatch custom metrics, Azure Monitor insights, Cloud Monitoring; log aggregation (CloudWatch Logs, Log Analytics)
- Cost management — RI/SP purchasing, cost allocation tags, AWS Cost Explorer / Azure Cost Management analysis
- Basic networking — Firewalls, security groups, WAF, DDoS protection (AWS Shield, Azure DDoS Protection)
- Git / version control — Advanced: branching strategies, code review, CI/CD integration
Recommended Certifications (Associate Level)
| Certification | Code | Vendor | Effort | Cost | Notes |
|---|---|---|---|---|---|
| AWS Solutions Architect Associate | SAA-C03 | AWS | 100–150 hrs | $150 | Most valuable cert for career progression; high market demand |
| AWS Developer Associate | DVA-C02 | AWS | 80–120 hrs | $150 | Useful if writing application code / Lambda functions |
| AWS CloudOps Engineer Associate | SOA-C03 | AWS | 100–150 hrs | $150 | Replaced SOA-C02 on Sept 30, 2025; SysOps focus |
| Microsoft Azure Administrator | AZ-104 | Microsoft | 100–150 hrs | $165 | Parallel to AWS SAA; strong if targeting Azure |
| GCP Associate Cloud Engineer | ACE | 100–150 hrs | $200 | Less saturated job market than AWS/Azure; still valuable | |
| HashiCorp Terraform Associate | 004 | HashiCorp | 60–90 hrs | $70 | IaC specialty; scheduling began Dec 9, 2025; 60-min online proctored exam |
Note on AWS SOA-C03: The AWS Certified SysOps Administrator - Associate (SOA-C02) was retired on Sept 29, 2025. The replacement, AWS Certified CloudOps Engineer - Associate (SOA-C03), launched Sept 30, 2025.
Source: AWS Certification Retirements, HashiCorp Terraform Associate 004
Paid Learning Pathways (Associate Level)
- Adrian Cantrill AWS Solutions Architect Associate Course — Highly rated (4.9/5 stars); lifetime access; ~40–50 hours; includes practice exams
- John Savill Azure Administrator (AZ-104) Course — Free video series on YouTube; incredibly detailed; pairs well with paid Pluralsight courses
- Stephane Maarek Ultimate AWS Certified Solutions Architect Associate — Udemy; ~$15–50 on sale; highly rated
- Tutorials Dojo Practice Exams — Excellent practice test quality; $20–40 per course
- Pluralsight — $30–50/month subscription; comprehensive AWS, Azure, GCP learning paths
- Google Cloud Skills Boost — Structured labs; $30–50/month
Essential Reading (Associate Level)
| Book | Author | Publisher | Year | URL | Notes |
|---|---|---|---|---|---|
| AWS Well-Architected Framework | Amazon Web Services | AWS | 2024 | Official PDF | Free; foundational; covers 5 pillars (operational excellence, security, reliability, performance, cost) |
| Cloud Native Patterns | Cornelia Davis | Manning | 2019 | Manning | ~$45–60; essential for understanding Kubernetes and microservices patterns |
| Architecting the Cloud: Design Decisions for Cloud Computing Service Models | Michael J. Kavis | Wiley | 2014 | Amazon | $30–40; SaaS/PaaS/IaaS architecture deep dive |
| The Phoenix Project | Gene Kim, Kevin Behr, George Spafford | IT Revolution | 2013 | Goodreads | ~$25; a novel about DevOps and IT transformation; highly readable |
Source: Cloud Native Patterns (Manning), AWS Well-Architected
Salary Progression (Associate Level, 2026)
| Region | Title | Annual Salary (USD / GBP / ZAR) | Notes |
|---|---|---|---|
| United States | Cloud Engineer (mid-level / 2–4 yrs) | $125,000–$160,000 USD | AWS certified professionals earn ~20% more than non-certified peers |
| United Kingdom | Cloud Engineer (2–4 yrs) | £55,000–£75,000 GBP | Robert Half Q1 2026 survey; London premium 15–20% above regional average |
| South Africa | Cloud Engineer (2–4 yrs) | ZAR 850,000–1,200,000 | ~$47,000–$66,000 USD; concentrated in Johannesburg and Cape Town |
Sources: Glassdoor AWS Solutions Architect, Robert Half Cloud Engineer (UK), Glassdoor South Africa Cloud Engineer
STAGE 3: PROFESSIONAL (5–8 Years) — Senior Cloud Engineer / Cloud Solutions Architect
Day-in-the-Life
A Senior Cloud Engineer or Cloud Solutions Architect leads technical strategy and design. Responsibilities become architectural:
- Conducting Well-Architected reviews (AWS), architecture assessments (Azure), and best-practice audits
- Designing multi-account AWS organizations / multi-subscription Azure Landing Zones
- Defining cloud governance, security policies, and compliance frameworks (HIPAA, PCI-DSS, SOC 2, GDPR)
- Designing disaster recovery and business continuity strategies (RPO, RTO targets; failover automation)
- Leading FinOps initiatives — cost forecasting, Reserved Instance optimization, organizational chargeback models
- Mentoring teams; code/design review; architectural decision documentation (ADRs)
- Working with vendors on contract negotiation, SLA definition, and service roadmaps
- Presenting to C-suite stakeholders; translating business requirements into technical architecture
- On-call rotation for critical production incidents
Stress level: High. Architectural decisions affect enterprise roadmaps. Stakes are high.
Remote-friendly: Yes, but some travel to customer sites or internal meetings expected.
Industry context: Demand remains very high. Senior Cloud Architects command premium salaries and have the most flexibility in role choice. This is often the last pure-technical role before moving into management.
Required Skills (Professional / Senior Level)
- Well-Architected reviews and assessments — AWS WAF, Azure Advisor, GCP Cloud Asset Inventory; identifying anti-patterns
- Multi-account / multi-subscription strategy — AWS Organizations, Azure Management Groups; cross-account IAM, billing consolidation
- Landing zones — AWS Control Tower, Azure Landing Zones; pre-configured blueprints; governance guardrails
- Advanced IAM — Cross-account role assumption; resource-based policies; service control policies (SCPs); identity federation
- Disaster recovery design — RPO/RTO targets; failover automation; database replication; backup strategies; chaos engineering
- Advanced networking — AWS Direct Connect, ExpressRoute, AWS Transit Gateway; DX resilience; multi-region failover
- FinOps mastery — Cost allocation; chargeback models; Reserved Instance / Savings Plan purchasing strategies; waste identification
- Kubernetes basics — EKS, AKS, GKE architecture; Helm; service mesh concepts (Istio, Linkerd); not deep-dive development
- Security architecture — Zero-trust networking; secrets management (Vault, Secrets Manager); encryption key management; audit logging
- Vendor negotiation — Understanding SLA terms, negotiating volume discounts, evaluating third-party services
Recommended Certifications (Professional / Senior Level)
| Certification | Code | Vendor | Effort | Cost | Notes |
|---|---|---|---|---|---|
| AWS Solutions Architect Professional | SAP-C02 | AWS | 150–200 hrs | $300 | Premier AWS credential; highest-value career progression cert |
| Microsoft Azure Solutions Architect Expert | AZ-305 | Microsoft | 150–200 hrs | $165 | Requires AZ-104 prerequisite; equivalent to AWS SAP |
| GCP Professional Cloud Architect | PCA | 120–180 hrs | $200 | Highly technical; valid 2 years; case-study format (20–30% of exam) | |
| Microsoft Azure DevOps Engineer Expert | AZ-400 | Microsoft | 120–150 hrs | $165 | If emphasizing CI/CD and automation over pure architecture |
| AWS DevOps Engineer Professional | DOP-C02 | AWS | 150–200 hrs | $300 | Complements SAP if emphasizing infrastructure automation and CI/CD |
| AWS Security Specialty | SCS-C03 | AWS | 100–150 hrs | $300 | Critical for security-focused architects; valid 3 years |
| AWS Advanced Networking Specialty | ANS-C01 | AWS | 100–150 hrs | $300 | Essential if building multi-region / hybrid architectures |
| Microsoft Azure Network Engineer Associate | AZ-700 | Microsoft | 100–150 hrs | $165 | Azure equivalent of ANS-C01 |
| HashiCorp Certified: Terraform Operations Practitioner | — | HashiCorp | 80–120 hrs | $70 | Lab-based; hands-on exam; IaC mastery credential |
| Certified Kubernetes Administrator | CKA | Linux Foundation / CNCF | 120–160 hrs | $395 | Performance-based (2-hour practical exam); k8s cluster troubleshooting |
| Certified Kubernetes Application Developer | CKAD | Linux Foundation / CNCF | 100–140 hrs | $395 | Application deployment and troubleshooting on k8s |
| Certified Kubernetes Security Specialist | CKS | Linux Foundation / CNCF | 130–180 hrs | $395 | Requires active CKA; container security, network policies, RBAC |
| FinOps Certified Practitioner | FOCP | FinOps Foundation | 60–90 hrs | $249 | Cloud cost management; 50-question, 60-min exam; valid 2 years |
Notes:
- AZ-305 retirement: AZ-305 (Azure Solutions Architect Expert) retires July 31, 2026. No direct replacement announced as of April 2026; monitor Microsoft Learn for updates.
- CKS requires CKA: Candidates must hold a current CKA to attempt CKS.
Sources: AWS Certification Retirements, Azure Certification Retirements, Linux Foundation CKA, FinOps FOCP
Paid Learning Pathways (Professional / Senior Level)
- Adrian Cantrill AWS Solutions Architect Professional (SAP-C02) — ~60–80 hours; lifetime access; practice exams; $50–200 depending on sale
- John Savill Azure Solutions Architect Expert (AZ-305) Study Cram — Free 4-hour video; exceptional high-level overview; pairs with paid Pluralsight courses
- Stephane Maarek Ultimate AWS Certified Solutions Architect Professional — Udemy; $15–50 on sale; comprehensive
- Pluralsight Azure Solutions Architect Path — $30–50/month; curated learning paths
- Linux Foundation Kubernetes Fundamentals (LF131) — $299; includes CKA exam bundle discounts
- A Cloud Guru (Pluralsight) — Hands-on labs; $30–50/month
Essential Reading (Professional / Senior Level)
| Book | Author(s) | Publisher | Year | URL | Notes |
|---|---|---|---|---|---|
| Designing Data-Intensive Applications (2nd Edition) | Martin Kleppmann | O'Reilly | 2026 | O'Reilly | $50–70; 2nd edition released 2026; covers distributed systems, databases, consensus; essential for architects |
| Cloud Native Patterns | Cornelia Davis | Manning | 2019 | Manning | $45–60; microservices, resilience, k8s patterns |
| Software Architecture: The Hard Parts | Neal Ford, Mark Richards | O'Reilly | 2021 | O'Reilly | $50–70; distributed architecture decision-making |
| The Software Architect Elevator | Gregor Hohpe | O'Reilly | 2020 | O'Reilly | $45–60; navigating organizational levels; architectural leadership |
| AWS Well-Architected Framework | Amazon Web Services | AWS | 2024 | Official | Free PDF; deep study required |
Source: Designing Data-Intensive Applications 2nd Edition (O'Reilly)
Salary Progression (Professional / Senior Level, 2026)
| Region | Title | Annual Salary (USD / GBP / ZAR) | Notes |
|---|---|---|---|
| United States | Senior Cloud Engineer / Solutions Architect (5–8 yrs) | $180,000–$240,000 USD | Top tier in non-FAANG tech companies; FAANG adds stock/bonus (30–50%) |
| United Kingdom | Senior Cloud Architect (5–8 yrs) | £90,000–£130,000 GBP | London premium; contract rates £70–100/hr |
| South Africa | Senior Cloud Engineer (5–8 yrs) | ZAR 1,300,000–1,800,000 | ~$72,000–$100,000 USD; significant Johannesburg/Cape Town variation |
Sources: Glassdoor AWS Solutions Architect, Robert Half Cloud Engineer (UK), Glassdoor South Africa Senior Cloud Engineer
STAGE 4: EXPERT (8+ Years) — Principal Cloud Architect / Distinguished Cloud Architect / Cloud Transformation Lead
Day-in-the-Life
A Principal Cloud Architect is a senior technical leader and strategic advisor at the C-level. Responsibilities are heavily architectural and organizational:
- Setting multi-cloud strategy (AWS / Azure / GCP / hybrid / on-premises)
- Driving cloud governance and establishing architectural review boards
- Leading zero-trust security architecture initiatives enterprise-wide
- Conducting strategic architecture assessments for enterprise acquisitions or major digital transformations
- Negotiating vendor contracts, SLAs, and volume commitments
- Mentoring other architects; building architecture communities of practice
- Presenting to executive leadership and board members
- Researching emerging technologies (AI/ML infrastructure, quantum-readiness, edge computing, Kubernetes 2.0)
- Managing architectural debt and long-term technology roadmaps
- Guiding organizational DevOps transformation and FinOps maturity
Stress level: Very high, but mostly strategic rather than tactical. Decisions affect multi-year roadmaps and billions in expenditure.
Remote-friendly: Selective. Travel to customer sites, conferences, and board meetings is common.
Industry context: This is the peak of the technical track (before pivoting to management). Demand is high but highly specialized. Most roles are in FAANG, financial services, healthcare, and large enterprises.
Required Skills (Expert / Principal Level)
- Multi-cloud strategy — Understanding strengths/weaknesses of AWS vs. Azure vs. GCP vs. OCI; when to use each; avoiding vendor lock-in
- Cloud governance at scale — Cloud CoE (Center of Excellence) design; policy frameworks; compliance automation (Config, Policy as Code)
- Zero-trust architecture — Principle of least privilege across network, identity, data, and applications; conditional access; security posture scoring
- Enterprise cost optimization — Unit economics; chargeback models; RI/SP purchasing at scale; cloud financial operations (FinOps)
- Data architecture — Modern data lakes, data warehouses, lakehouses; streaming; governance; Spark, Iceberg, Delta Lake
- AI/ML infrastructure — Training infrastructure (GPUs, TPUs); inference serving; MLOps; vector databases; RAG (Retrieval-Augmented Generation)
- Organizational leadership — Change management; vendor management; budget negotiation; communication with C-suite
- Emerging tech radar — Keeping abreast of quantum computing, edge computing, advanced kubernetes, serverless trends
Recommended Certifications (Expert / Principal Level)
| Certification | Code | Vendor | Effort | Cost | Notes |
|---|---|---|---|---|---|
| Multiple Cloud Pro certs | SAP-C02 + AZ-305 + PCA | AWS + Azure + GCP | 400+ hrs | $600+ | Multi-cloud credibility; AWS SAP + Azure AZ-305 + GCP PCA trio valued by enterprises |
| TOGAF Enterprise Architecture Practitioner | OGEA-102 | The Open Group | 80–120 hrs | $1,100–1,500 | Enterprise architecture credential; complements cloud certs; non-expiring |
| Open CA (Candidate / Chartered Architect) | OCA / OCP | The Open Group | Portfolio-based | Variable | Portfolio review; evidence-based rather than exam-based |
| AWS Specialty Certifications | SCS-C03 + ANS-C01 + DAS-C01 | AWS | 100–150 hrs each | $300 each | Security, Networking, or Data Analytics specialty; signals depth |
Notes:
- TOGAF OGEA-102 is scenario-based (8 questions), supervised, open-book, 90 minutes. Prerequisites: OGEA-101 (Foundation) or combined exam OGEA-103.
- Open CA (OCA/OCP) requires portfolio submission and peer review; no time limit; non-expiring once granted.
Sources: The Open Group TOGAF Certification
Paid Learning Pathways (Expert / Principal Level)
- Global Knowledge TOGAF Training — $2,000–4,000; instructor-led or self-paced
- Adrian Cantrill Multi-Professional Bundle — AWS SAP + other professional certs; $100–300 bundled
- Pluralsight Enterprise Architecture Path — $30–50/month; TOGAF + organizational leadership modules
- Executive education / custom consulting — Internal or external; varies widely
Essential Reading (Expert / Principal Level)
| Book | Author(s) | Publisher | Year | URL | Notes |
|---|---|---|---|---|---|
| Building Evolutionary Architectures | Neal Ford, Rebecca Parsons, Patrick Kua | O'Reilly | 2017 | O'Reilly | $40–60; architecture fitness; modular design |
| Cloud Strategy | Gregor Hohpe | O'Reilly | 2021 | O'Reilly | $40–60; business-to-tech alignment |
| The Architecture of Open Source Applications | various | Lulu | 2012 | Free online | Free; essays on design decisions in large systems |
| Technology Strategy Patterns | Eben Hewitt | O'Reilly | 2018 | O'Reilly | $40–60; technical strategy, organizational context |
Salary Progression (Expert / Principal Level, 2026)
| Region / Company | Title | Total Compensation (USD) | Notes |
|---|---|---|---|
| US FAANG | Principal Cloud Architect | $300,000–$500,000+ | Base $200–280K + stock 40–60% of base + bonus 20–40% |
| US Financial Services | Principal Cloud Architect | $250,000–$400,000 | Base $180–220K + bonus 40–80% + benefits |
| US Mid-Market Tech | Principal Architect | $200,000–$350,000 | Base $150–200K + stock/bonus variable |
| UK FAANG / Finance | Principal Cloud Architect | £200,000–£350,000 | ~$250,000–$440,000 USD equivalent; London concentrated |
| South Africa | Principal Cloud Architect | ZAR 3,000,000–5,000,000 | ~$165,000–$275,000 USD; rare positions; multinational companies |
Sources: Levels.fyi Principal Solution Architect (Microsoft), Levels.fyi Cloud Architect Salary (South Africa), Glassdoor Principal Cloud Architect
Lateral Career Pivots
Cloud Engineer → DevOps Engineer
Transition path: Cloud engineering and DevOps are highly overlapping. The pivot is typically sideways with a 3–6 month ramp.
Why: DevOps emphasizes automation, CI/CD, infrastructure observability, and incident response over architecture.
Required additions:
- CI/CD mastery: GitLab CI, GitHub Actions, Jenkins, Azure DevOps Pipelines
- Observability: Prometheus + Grafana, ELK Stack, Datadog, New Relic
- Infrastructure automation: Ansible, Puppet, Chef (beyond Terraform)
- Incident response: on-call rotations, chaos engineering (Gremlin), resilience testing
Relevant certs: AWS DevOps Engineer Professional (DOP-C02), Microsoft AZ-400 (DevOps Engineer Expert), Certified Kubernetes Administrator (CKA)
Sources: AWS DevOps Engineer Professional, Microsoft AZ-400
Cloud Engineer → Cloud Security Engineer
Transition path: Security engineering is more specialized. Requires 6–12 months of focused study and hands-on security work.
Why: Cloud security is increasingly critical; specialization commands premium salaries and is in very high demand.
Required additions:
- Security frameworks: NIST Cybersecurity Framework, CIS Benchmarks, AWS Well-Architected Security Pillar
- Secrets management: HashiCorp Vault, AWS Secrets Manager, Azure Key Vault
- Network security: WAF, DDoS protection, VPC Flow Logs, network ACLs, security group policy analysis
- Compliance & auditing: CloudTrail, Azure Activity Logs, AWS Config, compliance automation
- Identity & access: Advanced IAM, Okta/Azure AD, MFA, privilege escalation detection
- Container & Kubernetes security: Pod security policies, RBAC, network policies, image scanning
Relevant certs: AWS Security Specialty (SCS-C03), Microsoft Cloud Security Engineer (SC-500, launching May 2026), Certified Kubernetes Security Specialist (CKS)
Sources: AWS Security Specialty, SC-500 (Microsoft)
Cloud Engineer → Data Engineer
Transition path: Data engineering requires strong SQL, distributed computing, and ETL/ELT knowledge. 9–18 month pivot expected.
Why: Data engineers command strong salaries; data is foundational to every organization; career opportunities span industries.
Required additions:
- SQL mastery: Complex queries, query optimization, window functions, CTE
- Data warehousing: Snowflake, BigQuery, Redshift, Azure Synapse
- ETL/ELT tools: Airflow, dbt (data build tool), Spark, Beam
- Streaming: Kafka, Kinesis, Pub/Sub, Flink
- Big data: Spark, Hadoop ecosystem basics
- Data modeling: dimensional modeling, fact/dimension tables, slowly changing dimensions
Relevant certs: AWS Advanced Networking Specialty, GCP Data Engineer Associate, Databricks Certified Associate Data Engineer
Sources: GCP Data Engineer Associate
Cloud Engineer → Cloud Network Engineer
Transition path: Network engineering is a natural lateral move. 3–6 months of focused networking study.
Why: Multi-region, hybrid, and edge architectures drive demand for specialized network architects.
Required additions:
- Advanced networking: BGP, MPLS, route optimization, DX / ExpressRoute / Interconnect deep dive
- Hybrid connectivity: Site-to-Site VPN, IPSec, Transit Gateways, VPC Peering, service endpoints
- Edge / CDN: CloudFront, Azure CDN, Cloud CDN, DDoS mitigation, origin failover
- DNS & traffic management: Route 53, Azure Traffic Manager, Cloud DNS, geolocation routing
- Network troubleshooting: tcpdump, Wireshark, netstat, traceroute, VPC Flow Logs analysis
Relevant certs: AWS Advanced Networking Specialty (ANS-C01), Microsoft Azure Network Engineer Associate (AZ-700)
Sources: AWS Advanced Networking Specialty, Azure Network Engineer Associate (AZ-700)
2026 Certification Retirements & Updates
Scheduled Retirements (Active as of April 30, 2026)
| Certification | Code | Vendor | Retirement Date | Replacement | Status |
|---|---|---|---|---|---|
| AWS Machine Learning Specialty | MLS-C01 | AWS | March 31, 2026 | AWS Machine Learning Engineer Associate | RETIRING (30 days) |
| Azure Developer Associate | AZ-204 | Microsoft | July 31, 2026 | AI-200 (Azure AI Cloud Developer Associate) | RETIRING (3 months) |
| Azure Solutions Architect Expert | AZ-305 | Microsoft | July 31, 2026 | TBD (monitor Microsoft Learn) | RETIRING (3 months) |
| Azure Security Engineer Associate | AZ-500 | Microsoft | September 30, 2026 | SC-500 (Cloud and AI Security Engineer, beta May 2026) | RETIRING (5 months) |
| Azure Hybrid Engineer Associate | AZ-800 | Microsoft | September 30, 2026 | AZ-802 (beta expected June 2026) | RETIRING (5 months) |
Source: Azure Certification Retirements 2026
Recent Changes (Since April 2025)
- AWS Certified SysOps Administrator - Associate (SOA-C02) retired Sept 29, 2025 → AWS Certified CloudOps Engineer - Associate (SOA-C03) launched Sept 30, 2025
- Azure Data Engineer Associate (DP-203) retired March 31, 2025 → Fabric Analytics Engineer Associate (DP-700) now current
Source: AWS Certification Retirements
YouTube & Independent Learning Resources
Recommended YouTube Channels
| Channel | Host(s) | Content | Language | Notes |
|---|---|---|---|---|
| NTFAQGuy | John Savill | Azure deep dives; AZ-305 study cram (4 hrs) | English | Exceptional clarity; covers AZ-104, AZ-305, AZ-400, AZ-700, AZ-500 |
| ExamPro | Andrew Brown | AWS/Azure/GCP free exam prep; live study sessions | English | High production quality; FreeCodeCamp partnership |
| Adrian Cantrill | Adrian Cantrill | AWS in-depth courses; paid but high quality | English | SAA-C03, SAP-C02, security, networking; lifetime access |
| Stephane Maarek | Stephane Maarek | AWS Udemy courses; deep technical dives | English | DVA-C02, SAA-C03, SAP-C02, security specialty |
| Google Cloud Tech | Google Cloud team | Official GCP tutorials; architecture guidance | English | Best for ACE, PCA, data engineer content |
| Adam Marczak | Adam Marczak | Azure fundamentals to advanced | English | AZ-900, AZ-104, AZ-305, hands-on demos |
Recommended Free Courses & Tutorials
- Microsoft Learn — Free, official Microsoft training paths; AZ-900, AZ-104, AZ-305, AZ-700, AZ-400
- AWS Skill Builder Free Tier — Free AWS fundamentals; paid tier adds labs and exams
- Google Cloud Skills Boost — Free 30-day trial; structured hands-on labs
- HashiCorp Learn — Free Terraform tutorials; associate exam study path
- Linux Foundation Open Source — Free and paid Kubernetes, cloud-native training
Summary: Progression Checklist
Entry (0–2 years) — Cloud Support Associate / Junior Cloud Engineer
- Earn one foundational cert (AWS CLF-C02, Azure AZ-900, or GCP GDL)
- Build proficiency with one cloud (AWS, Azure, or GCP)
- Learn Terraform or CloudFormation basics
- Understand VPC/VNet and security groups
- Complete 50–100 support tickets independently
- Read AWS Well-Architected Framework or Azure Architecture Center
- Expected salary: $95K–$120K USD
Associate (2–4 years) — Cloud Engineer
- Earn AWS SAA-C03 or Azure AZ-104 or GCP ACE (required)
- Write Infrastructure-as-Code modules from scratch
- Design multi-AZ / multi-region architectures
- Implement IAM policies and understand cross-account access
- Lead cost optimization initiatives
- Mentor junior engineers
- Read 2–3 architecture books (Cloud Native Patterns, The Phoenix Project, Architecting the Cloud)
- Expected salary: $125K–$160K USD
Professional (5–8 years) — Senior Cloud Engineer / Solutions Architect
- Earn AWS SAP-C02 or Azure AZ-305 or GCP PCA (required)
- Earn 1–2 specialty certs (Security SCS-C03, Networking ANS-C01, or FinOps FOCP)
- Conduct Well-Architected reviews; lead architectural assessments
- Design landing zones and multi-account strategies
- Lead FinOps initiatives; optimize cloud spend
- Study Kubernetes basics; understand CKA/CKAD at conceptual level
- Present to C-level stakeholders regularly
- Mentor architecture teams; code/design reviews
- Read advanced architecture books (Designing Data-Intensive Applications 2nd ed., Software Architecture: The Hard Parts, The Software Architect Elevator)
- Expected salary: $180K–$240K USD
Expert (8+ years) — Principal Cloud Architect / Distinguished Architect
- Hold multiple Professional certs (AWS SAP-C02 + Azure AZ-305 + GCP PCA ideal)
- Consider TOGAF Enterprise Architecture Practitioner (OGEA-102)
- Lead multi-cloud strategy and organizational cloud governance
- Design zero-trust architectures at enterprise scale
- Negotiate vendor contracts and SLA terms
- Mentor other architects; drive architecture communities of practice
- Deep knowledge of emerging tech (AI/ML infra, quantum-readiness, edge computing)
- Present to board-level stakeholders; shape C-level strategy
- Read advanced organization/strategy books (Cloud Strategy, Enterprise Architecture as Strategy, Building Evolutionary Architectures)
- Expected salary: $300K–$500K+ USD (FAANG/finance)
Sources
Salary & Market Data
- Glassdoor Cloud Engineer Salary (US)
- Glassdoor AWS Solutions Architect Salary
- Glassdoor Principal Cloud Architect Salary
- Robert Half Cloud Engineer (UK London)
- Robert Half Tech Salary Guide 2026
- Glassdoor South Africa Cloud Engineer
- Glassdoor South Africa Junior Cloud Engineer
- Glassdoor South Africa Senior Cloud Engineer
- Levels.fyi Microsoft Principal Solution Architect
- Levels.fyi Cloud Architect (South Africa)
AWS Certifications & Retirements
- AWS Cloud Practitioner
- AWS Solutions Architect Associate (SAA-C03)
- AWS Solutions Architect Professional (SAP-C02)
- AWS Developer Associate (DVA-C02)
- AWS CloudOps Engineer Associate (SOA-C03)
- AWS DevOps Engineer Professional (DOP-C02)
- AWS Security Specialty (SCS-C03)
- AWS Advanced Networking Specialty (ANS-C01)
- AWS Certification Retirements & Launches
Azure Certifications & Retirements
- Azure Fundamentals (AZ-900)
- Azure Administrator (AZ-104)
- Azure Solutions Architect Expert (AZ-305)
- Azure DevOps Engineer Expert (AZ-400)
- Azure Network Engineer Associate (AZ-700)
- SC-500 (Cloud and AI Security Engineer)
- Microsoft Certification Retirements 2026
GCP Certifications
- GCP Cloud Digital Leader
- GCP Associate Cloud Engineer
- GCP Professional Cloud Architect
- GCP Professional Cloud Architect 2026 Guide
Oracle Certifications
HashiCorp Certifications
- HashiCorp Terraform Associate 004
- HashiCorp Terraform Associate 004 Exam Guide (2026)
- HashiCorp Developer Terraform Tutorials
Kubernetes Certifications
- Linux Foundation Certified Kubernetes Administrator (CKA)
- Linux Foundation Certified Kubernetes Application Developer (CKAD)
- Linux Foundation Certified Kubernetes Security Specialist (CKS)
- Kubernetes Training & Certifications
Enterprise Architecture
FinOps
Books & Learning Resources
- AWS Well-Architected Framework
- Cloud Native Patterns (Manning)
- Designing Data-Intensive Applications, 2nd Edition (O'Reilly)
- The Software Architect Elevator (O'Reilly)
- Building Evolutionary Architectures (O'Reilly)
- Cloud Strategy (O'Reilly)
Learning Platforms & Instructors
- Microsoft Learn
- Adrian Cantrill AWS Solutions Architect Professional
- John Savill Azure Solutions Architect Expert Study Cram
- Google Cloud Skills Boost
- AWS Skill Builder
- Pluralsight
Document Version: 1.0
Last Updated: April 30, 2026
Author: IT Career Roadmap Project
Citation: Use as: "Cloud Engineer to Architect Roadmap, IT Career Roadmap (April 2026)"