Google Cloud Security Engineer Study Roadmap

Domain 1: IAM — Resource hierarchy, IAM roles (primitive/predefined/custom), conditions, workload identity

Domain 1: Identity — Cloud Identity, SSO, SAML, service accounts, workforce/workload identity federation

Domain 2: Logging — Cloud Audit Logs (Admin/Data/System), Cloud Logging, log sinks and exports

Domain 2: Incident Response — Security Command Center, Chronicle SIEM, threat detection, remediation

Domain 3: VPC Security — Firewall rules/policies, VPC Service Controls, Private Google Access, Cloud NAT

Domain 3: Network Security — Cloud Armor (DDoS/WAF), Identity-Aware Proxy, load balancer security

Domain 4: Compliance — Organization policies, Assured Workloads, regulatory frameworks, data residency

Domain 4: Privacy — DLP API, data classification, data retention policies, access transparency

Domain 5: Encryption — CMEK, CSEK, Cloud KMS, Cloud HSM, encryption at rest and in transit

Domain 5: Key Management — Key rotation, key versions, Confidential Computing, Certificate Authority Service

Domain 5: Secret Management — Secret Manager, workload identity, secure CI/CD pipelines

Full Review: Practice exams, Hands-on labs, Weak areas, Exam logistics