Tech hiring Cloud, DevOps & security
Hire cloud engineers who design for failure.
A cloud engineer designs and runs the foundations your software sits on in AWS, Azure or Google Cloud: accounts, networks, identity, compute, storage and the bill. Decisions made here are slow and costly to reverse, so we shortlist engineers who can explain the trade-offs behind an architecture as well as build it.
01 The role
What cloud engineers do all week, and what comes out of it.
A cloud engineer decides how your systems are laid out on a cloud provider and then builds that layout in code. They set up the account and organisation structure, design networks and connectivity, define who and what can access each resource, choose between virtual machines, containers, serverless and managed services, and plan backup and recovery.
Provisioning resources is the simple part; any console can do it. The difficulty lies in the decisions that are painful to undo: an address plan that does not collide with a customer’s network two years later, permissions narrow enough to contain a breach yet workable for developers, an architecture that survives the loss of a zone, and a bill that grows more slowly than usage. Most cloud incidents and most cloud overspend trace back to an early default nobody questioned.
The role is architecture-led where DevOps is delivery-led. A DevOps engineer cares most about how a change reaches production; a cloud engineer cares about what production is made of and what it costs. Cloud engineers tend to go deep in one provider, carry its certifications, and own migrations: from a data centre, from one provider to another, or from hand-built servers to managed services.
What they ship
- Landing zones: organisation, accounts, guardrails and central logging
- Network designs: VPCs, subnets, peering, private connectivity and DNS
- Identity and access models built on roles, federation and least privilege
- Migrations from data centres or hand-built servers to managed services
- Multi-zone and multi-region architectures with tested failover
- Backup, restore and disaster-recovery plans that have been rehearsed
- Cost reporting, tagging, budgets and commitment purchases
02 Skills and stack
Skills to look for, in three columns.
Depth in one provider transfers to another more slowly than people expect, especially in identity and networking. Say which cloud you run, or that the choice is still open.
Core
The role cannot be done without these.
- One provider in depth: AWS, Azure or Google Cloud
- Networking: routing, DNS, load balancing, TLS, VPN
- Identity and access management
- Infrastructure as code
- Compute choices: VMs, containers, serverless
- Storage and managed database services
- Resilience and disaster-recovery design
- Cost modelling and FinOps practice
Tooling
Varies from team to team.
- Terraform or OpenTofu; Pulumi
- CloudFormation and CDK, or Bicep on Azure
- AWS: Organizations, IAM Identity Center, VPC, EC2, S3, RDS, Lambda
- Azure: Entra ID, Virtual Networks, AKS, Functions
- Google Cloud: IAM, VPC, GKE, Cloud Run, BigQuery
- Managed Kubernetes (EKS, AKS, GKE) or ECS and Fargate
- CloudWatch, Azure Monitor or Cloud Monitoring
- KMS, Secrets Manager and Key Vault
- Cost Explorer, Azure Cost Management or Cloud Billing reports
- Policy as code: OPA, Sentinel, SCPs or Azure Policy
Adjacent
Useful, not required.
- CI/CD pipelines for infrastructure changes
- Kubernetes operations
- Compliance frameworks: SOC 2, ISO 27001, PCI DSS
- Database administration and migration tooling
- Data platform services: warehouses, streaming, object lakes
- Scripting in Python, Bash or PowerShell
03 When to hire one
Hire a cloud engineer for the right problem, or hire someone else.
Most hiring mistakes are made before the job description is written. Read both lists before you brief us.
Hire a cloud engineer when
-
You are leaving a data centre or a hosting company
A migration is a one-off project with a long tail. Copying servers as they are is quick and expensive to run; someone has to decide what to rebuild on managed services.
-
The cloud bill is growing faster than revenue
Oversized instances, idle environments, data-transfer charges and no tagging are common causes. A cloud engineer finds them and changes the architecture so they stay fixed.
-
Everything runs in one account with broad admin access
It was fine with five engineers. Now a mistake in a test script can reach production data, and a customer’s security questionnaire asks how you separate them.
-
A customer or regulator wants data in a specific region
Data residency, private connectivity to a client’s network or a recovery-time commitment in a contract all need deliberate design, not a new checkbox.
-
One zone outage would take the whole product down
Single points of failure hide in databases, NAT gateways and DNS. Designing them out, and proving the failover works, is core cloud engineering.
Look elsewhere when
-
The cloud is fine, but shipping code is slow and manual
Pipelines, environments and deployment automation are the delivery side of the house. That is a DevOps brief.
Hire DevOps engineers -
The architecture is sound and you still have outages
Alerting, on-call, service-level objectives and incident reviews are reliability practice, which is a specialism of its own.
Hire site reliability engineers -
You run one app on a platform-as-a-service
If Heroku, Render or Vercel meets your needs, there is little for a cloud engineer to design. A developer who understands deployment will do.
Hire full-stack developers -
The main need is penetration testing or a security programme
Cloud engineers build secure foundations. Testing them adversarially, running detection and owning policy belongs to a security specialist.
Hire security engineers -
The work is pipelines for analytics data
Warehouses, orchestration and data modelling use cloud services but are a different discipline with their own tools.
Hire data engineers
04 How we assess
Four checks, before a name reaches you.
A CV says what someone claims. We test what they can do, then send you the evidence with the shortlist.
-
Stage 1
Profile review
We look for environments the candidate designed and stayed responsible for: which provider, how many accounts and workloads, what was migrated and what it cost. Certifications are noted, but we weigh them below evidence of decisions made and lived with.
-
Stage 2
Technical test
A timed test covering networking, identity, compute and storage on the candidate’s main provider, with scenario tasks such as finding the fault in a network design, tightening an over-broad access policy or choosing services for a stated workload.
-
Stage 3
Conversation with our team
Our engineers ask the candidate to draw and defend an architecture they built: why it was laid out that way, what happens when a zone fails, how access is granted and what they would change now. We listen for cost and failure being considered unprompted.
-
Stage 4
Review and levelling
Reviewers score accuracy, speed, problem-solving, communication and teamwork, then assign a level from our DevOps framework. For cloud roles the notes record which provider the person is deep in and how large an estate they have designed.
-
Then
Your shortlist
Assessed candidates, with notes and scores.
The engine
Evalia
Assessments run on Evalia, the assessment platform we built ourselves. Across the ProDevs network, more than 100,000 assessments have been completed.
The levels we assign are public. Read the DevOps framework, or see how a hire runs from brief to offer.
05 Seniority
Three levels. What each one can own.
The title on a CV tells you little. What matters is how much a cloud engineer can be handed without someone checking each step.
Junior
Owns resources inside a design
- Provisions and changes resources through existing infrastructure code
- Understands core services and can read a network diagram and an IAM policy
- Handles routine requests: access, DNS records, certificates, scaling changes
- Needs a senior to review anything involving networking, identity or data
Mid-level
Owns a workload’s infrastructure
- Designs and builds the infrastructure for a new service within set guardrails
- Writes reusable modules and keeps environments consistent
- Diagnoses connectivity, permission and performance faults across services
- Finds and removes waste in the bill without harming resilience
Senior
Owns the cloud architecture
- Designs the account structure, network topology and identity model
- Plans and leads migrations, including the cut-over and the way back
- Sets recovery objectives with the business and proves they can be met
- Forecasts spend and negotiates the balance of cost, resilience and speed
Indicative salary
DevOps and cloud engineers. Annual, in US dollars, for remote roles with US, UK and EU companies.
- Mid-level
- $35–60k
- Senior
- $60–90k
- Typical US equivalent
- $130–200k
Indicative market ranges as of August 2026, based on ProDevs placement experience and published market data. The exact figure depends on stack, seniority and time-zone requirements. See the full cost breakdown.
06 Interview questions
Questions for cloud engineers, and what to listen for.
For your own interviews, after ours. Each question comes with what a strong answer tends to show.
-
Draw the network for a three-tier web application. What is public, what is private, and why?
A good answer shows: Only the load balancer faces the internet; application and database tiers sit in private subnets across at least two zones, with controlled outbound access. They should explain each boundary. A design with everything in public subnets ends the conversation.
-
How would you structure accounts or subscriptions for a company with three teams and two environments?
A good answer shows: Separation of production from everything else, central identity and logging, guardrails applied from the organisation level, and a reason for where they drew the lines. One account with naming conventions is the answer of someone who has not been burned yet.
-
A service needs to read from one storage bucket. How do you grant that?
A good answer shows: A role attached to the workload with a policy scoped to that bucket and those actions, with no long-lived keys. They should also say how they would check what a policy actually allows. Wildcard permissions “to get it working” are the warning sign.
-
Our bill went up 40% last month and nobody knows why. How do you find out?
A good answer shows: They break spend down by service, account and tag, compare it with the previous period and look at usage types: data transfer, storage growth, forgotten resources. Then they separate a one-off fix from the control that stops it recurring.
-
What recovery time and recovery point would you propose for this system, and what would each cost?
A good answer shows: They ask what an hour of downtime and an hour of lost data mean to the business before proposing anything, then map options from backup-and-restore to active-active with rough cost. Quoting “multi-region” without asking is architecture by reflex.
-
When is serverless the wrong choice?
A good answer shows: Steady high-volume workloads where it costs more, long-running or latency-sensitive jobs, and teams that will struggle to debug it. A balanced answer names where it is the right choice too. Enthusiasm with no downsides suggests limited production use.
-
Tell me about a migration cut-over you ran. What was the rollback plan?
A good answer shows: A rehearsed sequence: data synchronisation, a freeze window, DNS or traffic switch, validation checks and a defined point of no return. If there was no way back, they should say so and explain how they reduced the risk.
07 Ways to engage
Four ways to bring a cloud engineer in.
A permanent hire is the usual route, not the only one. Choose by how long the work lasts and who should employ the person.
- Placement fee, of first-year salary. One-time.
- 10–15%
- Replacement guarantee on direct hires.
- 2 weeks
- To a first shortlist, for most roles.
- 48h
-
Direct hire
A permanent employee on your contract and your payroll. One-time placement fee of 10–15% of first-year salary.
Tech hiring -
Dedicated team
A cloud engineer inside a team we assemble and run for you: product, design and engineering on your roadmap, for a monthly retainer.
Dedicated teams -
Outsourcing & payroll
A full-time person in a country where you have no legal entity. ProDevs employs and pays them: 20% of salary if we find the person for you, or 5% of salary, capped at $500 a month, for payroll and compliance on someone you have already chosen.
Outsourcing -
Freelance project
A defined piece of work with a clear end. You pay the agreed price per milestone through escrow, plus a 5% client fee. Free to post.
Freelancers
08 Around the role
Who cloud engineers depend on, and who depends on them.
A cloud engineer works one layer below the application teams. They set the foundations and the limits, then spend much of their time advising: reviewing designs, explaining why a shortcut is unsafe, and turning a product requirement into infrastructure the finance and security teams can also accept.
- DevOps engineer
- Provides the accounts, networks and permissions that pipelines deploy into, and agrees what teams may self-serve.
- Security engineer
- Turns security policy into guardrails, logging and access models that are enforced by the platform.
- Software developers
- Reviews service designs early and steers them towards managed services that fit the workload.
- Finance or operations lead
- Reports where the money goes, forecasts spend and recommends commitments.
- Database administrator
- Chooses instance classes, storage and replication topology for managed databases, and plans their migration.
09 Client testimonials
Hear it first-hand, from companies that hired.
Founders, operators and executives describe working with ProDevs, in their own words.
Play video: Client testimonial: Olufemi Seyi, COO, Casafina development company
Play video: Client testimonial: Aproko Doctor, Building AwaDoc
Play video: Client testimonial: JT Liddell, Promenade CEO
10 Questions
Before you hire a cloud engineer: the usual questions.
Something else? Book a call (opens in a new tab) and ask us directly.
-
Should we hire for AWS, Azure or Google Cloud specifically?
Hire for the provider you run. The concepts carry across, but identity, networking and service limits differ enough that a newcomer to your provider will take months to be fully effective. If you have not chosen yet, a senior engineer with experience of two providers can help you decide on evidence, not habit.
-
How much do cloud certifications matter?
They show that someone has studied a provider’s services in breadth, which is useful. They do not show that the person has designed an environment, lived with its bill or handled a failure. Treat a professional-level certification as a reason to interview, then ask about real architectures and the decisions behind them.
-
Can a cloud engineer reduce our cloud bill?
Usually, yes, though no honest person will promise a figure before seeing the account. The common sources of waste are oversized compute, idle non-production environments, unmanaged storage growth and data-transfer charges. The lasting savings come from architecture and from tagging and budgets that make spend visible to the teams causing it.
-
What is the difference between a cloud engineer and a DevOps engineer?
A cloud engineer designs and runs the platform: accounts, networks, identity, services and cost. A DevOps engineer builds the delivery path on top of it: pipelines, environments and deployment. In a small company one person often does both. As you grow, the split matters, because architecture decisions and pipeline work compete for the same hours.
-
Do we need a cloud architect or a cloud engineer?
The titles overlap. An architect produces designs and standards and may not build them; an engineer builds and operates. Most companies below a few hundred staff are best served by a senior cloud engineer who does both. Tell us how much of the role is design and how much is hands-on, and we shortlist accordingly.
-
How do you assess cloud engineers?
In four stages. We review environments the candidate has designed and run, set a timed technical test on their main provider, hold a conversation with our engineering team in which they defend an architecture, then review the results together and assign a level from our public DevOps framework. The assessments run on Evalia.
Talk to ProDevs
Tell us about the role.
Tell us the level and the stack. We will tell you how quickly we can put assessed cloud engineers in front of you.
Project work
Need it for a project instead?
Not every job needs a full-time hire. Describe the work, get proposals from vetted freelance cloud engineers, and pay per milestone through escrow. Free to post.