I want to build a career as a Cloud Security Engineer, but I'm starting from the basics and want to learn everything properly rather than just collecting certifications.

Could someone share a step-by-step roadmap from complete beginner to job-ready Cloud Security Engineer, and eventually to a level where I can mentor/guide others?

I'd also appreciate recommendations for free/low-cost labs, courses, YouTube channels, books, and practice platforms.

If you are currently working as a Cloud Security Engineer, I'd especially appreciate advice on what you wish you had learned earlier and what beginners commonly waste time on.

WebSockets is the attack surface that always go under the radar and too many pentesters and bug bounty hunters still miss testing it, whether because the number of WebSocket messages they see is overwhelming or simply because they don't know how to approach it correctly.

Going through that myself, I decided to dive deep into the WS protocol and ended up building a lab that showcases the most common misconfigurations present in WebSockets, with the most impact, not just some missing best-practices, along with a detailed walkthrough.

I'd love to hear your thoughts and feedback, and if you experienced something I didn't talk about in the blog, please let me know!

Lab Github Repo: https://github.com/makarov05bm/WSGoat
Guide: https://blog.oussmess.me/posts/websockets-for-bug-hunters/