Cloud engineering is not a single job. It spans infrastructure ops, security engineering, platform engineering, DevOps, and FinOps. The roadmap below is structured for someone starting from a sysadmin or on-premises networking background who wants to move into cloud roles in 2026. Adjust the entry point based on where you already are.
Stage 1: foundation (0-3 months)
The goal at stage 1 is to get comfortable with cloud fundamentals and pass a first cert to signal intent to employers.
- Pick one cloud first. Azure if you are in Europe or a Microsoft-heavy org. AWS if you are in the US or targeting startups. Do not try to learn both simultaneously at this stage.
- Core skills: Networking basics (TCP/IP, subnetting, DNS, firewalls), Linux command line, scripting basics (Bash or PowerShell), and an understanding of virtualisation.
- First cert: AZ-900 (if Azure) or AWS Cloud Practitioner (if AWS). These are 2-4 week commitments and cost under $100. They are not career-defining, but they confirm you know the vocabulary and signal commitment to a hiring manager.
Stage 2: associate level (3-9 months)
This is the most important stage. The associate cert is what most job descriptions list as a requirement for cloud engineering roles.
- Azure track: AZ-104 (Azure Administrator). Cost $165. Tests identity, storage, compute, networking, and monitoring. Hands-on labs are required preparation.
- AWS track: AWS SAA-C03 (Solutions Architect Associate). Cost $150. Tests secure, resilient, high-performing, and cost-optimised architectures.
- Hands-on time: Budget at least 100 hours of real work in the cloud. Build a home lab, contribute to an employer project, or use free-tier accounts. Reading without building does not produce exam-ready skills.
Stage 3: specialisation (9-18 months)
After the associate cert, the roadmap forks based on the role you are targeting.
Infrastructure and platform engineering
- AZ-305 (Azure Solutions Architect Expert) or AWS SAP-C02 for architecture breadth
- Terraform Associate certification for Infrastructure as Code credibility
- CKA (Certified Kubernetes Administrator) if your target role involves container platforms
Security engineering
- AZ-500 (Azure Security Engineer) or AWS Security Specialty
- CompTIA Security+ as a baseline if coming from a non-security background
FinOps and cloud financial management
- FinOps Certified Practitioner (FOCP) from the FinOps Foundation. Cost $300. Conceptual, 50 questions, 1 hour.
- Relevant for roles that own cloud spend, operate cost dashboards, or present cloud cost data to finance teams.
DevOps and automation
- AZ-400 (DevOps Engineer Expert) for Azure-specific CI/CD pipelines
- GitHub Actions, Terraform, and Ansible skills are expected in most platform roles regardless of cert
Skills that matter more than certs (but need certs to signal them)
The cert gets you the interview. These skills get you the job:
- Infrastructure as Code: Terraform or Bicep, not just portal clicking
- Monitoring and observability: Azure Monitor / CloudWatch, log querying with KQL or Athena
- Networking: VPN gateways, peering, network security groups, DNS resolution across VNets
- Identity and access management: RBAC, Entra ID (Azure AD), service principals, managed identities
- Scripting: Bash and PowerShell, enough to automate deployments and parse JSON output from CLI tools
Salary benchmarks (Netherlands market, 2026)
| Role | Typical annual salary (EUR) | Common certs required |
|---|---|---|
| Junior cloud engineer | €45,000 - €60,000 | AZ-900 or AZ-104 |
| Cloud engineer (mid) | €65,000 - €85,000 | AZ-104, AZ-305 or equivalent |
| Senior cloud engineer | €85,000 - €110,000 | AZ-305, AZ-500 or specialisation |
| Cloud architect | €100,000 - €130,000 | Expert-level certs, multi-cloud experience |
Infrastructure as Code: start here
# Terraform: initialise a new Azure project
terraform init
# Preview what will be created
terraform plan
# Deploy
terraform apply
# Bicep: deploy a resource group via Azure CLI
az deployment sub create --location westeurope --template-file main.bicep --parameters @main.parameters.json
Every cloud engineering job description in 2026 lists Terraform or Bicep. If you can write a working module that deploys a VNet with subnets and NSGs, you are ahead of most candidates who only know the portal.
How to structure 12 months
- Months 1-2: Foundation cert + core skills setup (Linux, networking, CLI tools)
- Months 3-6: Associate cert study + 100+ hours hands-on time
- Months 7-9: First job or role change using associate cert
- Months 10-12: Specialisation cert based on role (architecture, security, containers, or FinOps)
This is aggressive but achievable. The engineers who compress this timeline do daily lab work and treat cert prep as a second job for 6-9 months. Consistency beats cramming every time.