Google Cloud Security Engineer Study Roadmap

Domain 1: IAM. Resource hierarchy, IAM roles (primitive/predefined/custom), conditions, workload identity

Domain 1: Identity (Cloud Identity, SSO, SAML, service accounts, workforce/workload identity federation)

Domain 2: Logging. Cloud Audit Logs (Admin/Data/System), Cloud Logging, log sinks and exports

Domain 2: Incident Response (Security Command Center, Chronicle SIEM, threat detection, remediation)

Domain 3: VPC Security (Firewall rules/policies, VPC Service Controls, Private Google Access, Cloud NAT)

Domain 3: Network Security. Cloud Armor (DDoS/WAF), Identity-Aware Proxy, load balancer security

Domain 4: Compliance (Organization policies, Assured Workloads, regulatory frameworks, data residency)

Domain 4: Privacy (DLP API, data classification, data retention policies, access transparency)

Domain 5: Encryption (CMEK, CSEK, Cloud KMS, Cloud HSM, encryption at rest and in transit)

Domain 5: Key Management (Key rotation, key versions, Confidential Computing, Certificate Authority Service)

Domain 5: Secret Management (Secret Manager, workload identity, secure CI/CD pipelines)

Full Review: Practice exams, Hands-on labs, Weak areas, Exam logistics