Sign in with Google

Cloud Engineer

A cloud engineer owns the provider layer a company's software lives on: networks, identity, accounts, and the bill. This page explains what the work actually involves, what it pays in the U.S., how it differs from the three titles it gets confused with, and why certifications count for more here than almost anywhere else in software.

Typical Pay (US)*

$128kmedian*
$90k*
Entry
$128k*
Median
$172k*
Senior

* AI-estimated from general U.S. labor-market patterns — not measured data from the U.S. Bureau of Labor Statistics or any official source. Real pay varies widely by location, employer, experience, and timing.

Outlook

Rising demand*AI-augmented role

The nearest federal occupation, Computer Network Architects, carries an estimated median near $130,000 with a $99k-$165k band and employment growth around 2.4% — steady rather than explosive, which understates the title's real hiring volume because most cloud work is counted under other codes. AI is genuinely fast at the mechanical half of this job: generating Terraform, recalling which of forty services fits a use case, drafting a migration runbook, explaining an obscure error. It cannot be accountable for the security posture of an account holding customer data, and it has no stake in the cost-versus-resilience tradeoff you sign off on. The role compresses toward architecture judgment, security ownership, and cost discipline.

What does a Cloud Engineer do?

A cloud engineer designs, builds, and operates the infrastructure a company's software runs on inside AWS, Azure, or Google Cloud. The daily substance is provider surface area: VPCs, subnets, and peering; IAM roles and least-privilege policies; account and project structure; managed databases; load balancers and CDNs; backup and disaster-recovery posture; and the monthly invoice. You write Terraform or CloudFormation instead of clicking through consoles, you build the landing zone that new teams deploy into, and you answer a recurring question for the rest of the company: can we run this here, safely, and for how much? Migration work is constant — taking a service that lives on physical servers, or an EC2 instance someone launched in 2019 and nobody has patched since, and moving it onto something managed and reproducible.

Four titles overlap here, and postings blur them freely. A cloud engineer owns the provider layer: networking, identity, accounts, cost. A DevOps engineer owns the delivery path: pipelines, build systems, deployment automation, and the experience developers have when they ship. A cloud architect or solutions architect owns the decisions more than the keyboard — target-state diagrams, migration sequencing, vendor selection, and the design document that gets signed before anyone provisions a thing. A site reliability engineer owns how the system behaves in production: SLOs, error budgets, capacity, incident command. Federal occupational data folds much of this into Computer Network Architects, which explicitly lists "cloud architect" and "cloud network engineer" as alternate titles. At a small company one person is all four. When you read a job posting, sort it by what the responsibilities list first — that tells you which of the four you are actually interviewing for.

Certifications carry more weight in cloud engineering than nearly anywhere else in software, and the reason is specific. The platforms are enormous, proprietary, and revised every quarter, so a current AWS Solutions Architect Associate, Azure AZ-104, or Google Associate Cloud Engineer is credible evidence that you know a particular surface as it exists today — something no general computer-science credential can claim. Recruiters filter on them, consultancies need them to maintain partner status, and they cost a fraction of a degree in both money and months. What a certification does not do is prove you have built anything. Pair it with a repository that provisions a working environment from empty, or it reads as trivia.

The work suits people who find systems more interesting than features, who treat cost and security constraints as puzzles rather than obstacles, and who can be careful — a mistyped IAM policy or a public storage bucket is a news story, not a bug ticket. It suits you less if you want to write application code most of the day, or if you would rather go deep on one language than broad across an entire provider catalog. Note that the strongest cloud engineers are usually also competent software engineers; the ceiling on this career is set by how well you can code, not by how many services you can name.

A day in the life

  • Design the VPC and subnet layout for a new product environment, then write the Terraform module that will create it repeatably.
  • Get pulled into a cost review because one team's data-transfer charges tripled — the fix is a VPC endpoint, not a smaller instance.
  • Rotate an IAM access key a scanner found committed to a public repository, then add a pre-commit hook so it cannot recur.
  • Run a migration cutover at 6am: flip DNS, watch error rates climb and settle, keep the rollback one command away.
  • Answer an enterprise security questionnaire about encryption at rest and discover two storage buckets are out of compliance.
  • Talk a product team out of self-hosting Postgres and into a managed instance, with the cost and failover math written down.
  • Build a guardrail: a config rule that flags any security group opening 0.0.0.0/0 on a database port, org-wide.

How to become a Cloud Engineer

  1. 1

    Build real networking and Linux fundamentals first

    ~2 months

    Understand subnets, routing, DNS, TLS, and firewalls, plus enough Linux to debug a host — cloud consoles are abstractions over these, and the abstraction leaks constantly.

  2. 2

    Pick one provider and earn its associate-level certification

    ~3 months

    AWS Solutions Architect Associate, Azure AZ-104, or Google Associate Cloud Engineer will force you through the full service catalog and clears the recruiter screen most candidates fail.

  3. 3

    Learn infrastructure as code until clicking feels wrong

    ~3 months

    Write Terraform that stands up a network, a compute tier, a managed database, and monitoring from an empty account, then destroy and recreate it to prove it is reproducible.

  4. 4

    Study identity and security properly, not incidentally

    ~2 months

    Learn IAM policy evaluation, least privilege, key management, network isolation, and audit logging — most cloud incidents are permission mistakes rather than exotic attacks.

  5. 5

    Get production exposure through an adjacent seat

    ~6-12 months

    IT operations, infrastructure support, and junior platform roles all put you next to real accounts with real consequences, which is the experience certifications cannot manufacture.

  6. 6

    Specialize once you are hired

    ongoing

    Cost optimization, security engineering, Kubernetes platforms, and data infrastructure are the four common depth tracks, and each one raises your ceiling meaningfully.

Skills that matter

AWS, Azure, or GCP core servicesVPC networking, routing, and DNSIAM policy design and least privilegeTerraform or CloudFormationLinux administrationPython or Bash automationDocker and Kubernetes basicsCloud cost management and tagging strategyCloudWatch, Azure Monitor, or Cloud LoggingBackup and disaster-recovery designEncryption and certificate managementMigration planning and cutover execution

Learn the actual skills

Tell Mochivia your goal and it builds your personal curriculum — 15 minutes a day.

Build My Path

Frequently asked questions

What does a cloud engineer do?
A cloud engineer builds and runs the infrastructure a company's software depends on inside AWS, Azure, or Google Cloud. That means designing networks and account structures, writing IAM permissions, provisioning databases and compute through Terraform, setting up monitoring and backups, and controlling the cloud bill. A large share of the job is migration — moving systems off servers or hand-built instances onto managed, reproducible infrastructure.
How much do cloud engineers make?
U.S. cloud engineers typically start near $90,000, reach roughly $128,000 at mid-career, and earn about $172,000 or more at senior level. The closest federal occupation, computer network architects, reports a median around $130,000 with a band from roughly $99,000 to $165,000. These figures are AI-estimated from market patterns rather than measured statistics, and specialization in security or cost optimization pushes the top end higher.
Which cloud certification should I get first, and do I need a degree?
Start with one provider's associate tier: AWS Solutions Architect Associate, Azure AZ-104, or Google Associate Cloud Engineer. A degree is genuinely optional in this role — certifications plus a public repository that provisions working infrastructure will get interviews without one, which is unusual in engineering. Do not collect three certifications across three providers; hiring managers read that as breadth without depth. One provider, one cert, one real project.
Will AI replace cloud engineers?
No, though it has taken over a real slice of the work. AI writes Terraform, recalls which service fits a requirement, drafts migration plans, and decodes cryptic provider errors faster than any engineer. What stays human is accountability: someone has to own whether an account holding customer data is secure, whether the failover design survives a region outage, and whether the architecture is worth its monthly cost. Those are signature decisions, not generated text.
Is cloud engineering a good career in 2026?
Yes, and it is one of the better-value entry points in tech because the credential barrier is low relative to the pay. Nearly every company now runs on rented infrastructure, so demand is broad rather than concentrated in tech hubs, and the skills transfer directly into DevOps, security engineering, and data infrastructure. The main risk is staying purely operational — cloud engineers who never learn to write software plateau earlier than those who do.
What's the difference between a cloud engineer and a DevOps engineer?
A cloud engineer owns the provider layer: networking, identity, accounts, managed services, and cost. A DevOps engineer owns the delivery path: CI/CD pipelines, build and release automation, and how quickly developers can ship safely. The two overlap heavily around Terraform and Kubernetes, and at companies under about 200 people they are usually the same person. At scale they split, and the tell in a job posting is whether the first responsibility mentions infrastructure design or deployment pipelines.

Related careers

DevOps Engineer
DevOps engineering is the job of making software ship safely and often — pipelines, infrastructure as code, and the production plumbing underneath. This page covers what the work actually involves, what it pays in the U.S., what AI is genuinely automating, and a step-by-step path in if you're starting from somewhere else.
Cybersecurity Analyst
A cybersecurity analyst defends an organization against people actively trying to get in. This page covers what the work looks like hour by hour, what it pays, why it combines the fastest growth with the lowest automation exposure of any mainstream tech role, and how to solve the entry-level experience problem that blocks most newcomers.
Backend Developer
Backend development is where the correctness of a product actually lives — the data model, the money, the permissions, the thing that must not double-charge anyone. It is also the engineering specialty least affected by AI code generation, for a reason worth understanding. This page covers the work, the pay, and the two roles it gets confused with.
Data Engineer
Data engineers build the pipelines and storage that everyone else's dashboards, models, and metrics depend on. This page covers what the work actually is, what it pays, the specific tools that get you hired, and why most of the job is reliability and cost rather than cleverness.
Software Engineer
Software engineering is the highest-employment technical career in the United States — about 1.66 million people, at a $132,270 median. It is also the career most loudly declared dead by AI. This page gives you the honest version: what the job actually is, what it pays, which parts machines have already taken, and what to learn instead.

Sources