Enterprise spending on cloud infrastructure services reached $143 billion in the second quarter of 2026, up 43 percent in a year, the fastest growth Synergy Research Group has recorded in eight years.
Synergy names generative AI as the primary driver.
Every dollar of that spend runs on accounts, networks, clusters and pipelines that someone has to design, secure and keep within budget. In most US companies, that someone is the cloud engineer.
What is a Cloud Engineer?
A cloud engineer builds and runs a company's infrastructure on a public cloud such as Amazon Web Services (AWS), Microsoft Azure or Google Cloud.
The job covers the account structure, networking, compute, storage, identity and access, and the infrastructure-as-code that creates all of it.
In a startup, the cloud engineer is often the first infrastructure hire and owns everything below the application code.
In a larger company, the title usually means a member of a cloud team that runs landing zones, shared networking and guardrails that product teams deploy on top of.
The core output is infrastructure that is reproducible, secure by default and cheap enough to justify. A cloud engineer who clicks resources together in a web console is doing the job badly.
A good one can rebuild an environment from a Git repository.
Cloud Engineer Job Market and Salary in the US
The market is concentrated in three providers. Synergy's Q2 2026 cloud market report puts worldwide shares at 28 percent for Amazon, 20 percent for Microsoft and 15 percent for Google, with trailing twelve-month revenues of $500 billion.
Hiring managers want depth in whichever of the three they run, and working knowledge of a second.
Cost pressure shapes the work as much as growth does.
In Flexera's 2026 State of the Cloud report, 85 percent of the 753 respondents named cost as a top challenge, ahead of security at 82 percent, and they estimated 29 percent of their IaaS and PaaS spend was wasted.
Every respondent used generative AI services from a public cloud provider in some form, which adds GPU capacity and model endpoints to the cloud engineer's estate.
US Salary Benchmarks
The Bureau of Labor Statistics has no separate cloud engineer category. Its two closest occupations bracket the role:
- Network and computer systems administrators: median annual wage of $99,130 in May 2025, with the lowest 10 percent under $62,640 and the highest 10 percent above $155,050
- Computer network architects: median annual wage of $134,050 in May 2025, with the lowest 10 percent under $79,900 and the highest 10 percent above $202,680
Indeed's cloud engineer salary page reports an average US base salary of $136,073, based on 4,800 salaries from job postings over 36 months (updated October 12, 2026).
That lands close to the architect median, which matches how employers price the role: closer to design work than to system administration.
Approximate US pay bands by level, built from the figures above:
- Entry level: $62,640 to $99,130, the administrator band from lowest 10 percent to median
- Mid-level: $99,130 to $136,073, from the administrator median to the Indeed average
- Senior and principal: $134,050 to $202,680, from the architect median to the top 10 percent
The BLS outlook splits along the same line.
Administrator employment is projected to decline 4 percent from 2025 to 2035 as routine server work is outsourced, while network architect employment is projected to grow 8 percent, with BLS citing the continued expansion of cloud computing.
For a broader market picture, see the cloud development statistics roundup.
Cloud Engineer Responsibilities and Day-to-Day Work
Most of a cloud engineer's week is spent in code review and pull requests, not in a cloud console. Typical responsibilities:
- Infrastructure as code: writing and reviewing Terraform or OpenTofu modules for networks, clusters, databases and IAM, and running plans through CI
- Account and network design: multi-account or multi-subscription layouts, VPCs, subnets, private endpoints, DNS and connectivity to on-premises or partner networks
- Identity and security: least-privilege IAM roles, single sign-on for engineers, secrets management, encryption keys and audit logging
- Compute platforms: managed Kubernetes clusters, container services, serverless functions and the GPU instances that AI workloads need
- Cost control: tagging standards, budgets and alerts, rightsizing, reserved capacity and turning off idle environments
- Reliability: backups, multi-zone designs, disaster recovery tests and on-call support for infrastructure incidents
- Enablement: templates and guardrails that let product engineers deploy without filing a ticket
A normal day might start with an alert about a failed nightly backup, move to reviewing a pull request that opens a new database to a partner VPC, and end with a cost report showing that a forgotten GPU node pool has been running for a week.
The work is part design, part operations and part policing what everyone else provisions.
Essential Skills for Cloud Engineers
Core Technical Skills:
- Deep knowledge of one major cloud: compute, storage, networking, IAM and the managed database services
- Terraform or OpenTofu, including module design, remote state, workspaces and drift handling
- Networking fundamentals: CIDR planning, routing, load balancers, DNS, TLS and firewall rules
- Linux administration and shell scripting, plus Python or Go for automation
- Containers and Kubernetes, at least to the level of running managed clusters such as EKS, AKS or GKE
- CI/CD pipelines that run infrastructure plans, policy checks and deployments
Security and Cost Skills:
- Writing IAM policies that grant exactly what a service needs and nothing more
- Reading a cloud bill and tracing a spike to a specific resource or team
- Policy as code to block public storage buckets, unencrypted volumes or untagged resources before they ship
Working Skills:
- Writing short design documents that explain trade-offs to engineers and managers
- Calm incident handling and clear post-incident write-ups
- Saying no to a risky shortcut and offering a safe alternative
Cloud Engineer Career Paths
Few engineers start as cloud engineers. The common entry routes are systems administration, network engineering, help desk to operations, and software engineering for developers who drift toward infrastructure.
- Junior cloud engineer or cloud support engineer: runs existing infrastructure, handles tickets and changes, learns the provider's services
- Cloud engineer: owns environments end to end, writes infrastructure-as-code modules and joins the on-call rotation
- Senior cloud engineer: designs account and network structure, sets security and tagging standards, mentors others
- Cloud architect or principal engineer: sets multi-year platform direction, picks providers and services, and signs off on major designs
From the senior level, the role branches. Engineers who enjoy building internal products move into platform engineering. Those drawn to uptime and incident work move into site reliability engineering.
Others specialize in cloud security, cloud networking or FinOps, or move into engineering management of an infrastructure team.
Tools, Platforms and Certifications
Kubernetes is now the default compute layer in many cloud estates.
The CNCF 2025 Annual Cloud Native Survey found that 82 percent of container users run Kubernetes in production, up from 66 percent in 2023, and that 66 percent of organizations hosting generative AI models use Kubernetes for some or all of their inference workloads.
Cloud Platforms
- AWS: EC2, VPC, IAM, S3, RDS, EKS, Lambda and Organizations for multi-account setups
- Microsoft Azure: virtual networks, Entra ID, AKS, Azure Resource Manager templates and Bicep
- Google Cloud: Compute Engine, GKE, Cloud Run, BigQuery and shared VPC
Infrastructure as Code
Terraform and OpenTofu share one configuration language.
HashiCorp moved its products from the MPL 2.0 license to the Business Source License on August 10, 2023, and the community fork OpenTofu now runs under Linux Foundation stewardship as a drop-in replacement.
Companies with license concerns, or that resell infrastructure tooling, often choose OpenTofu. The skills transfer almost entirely. Our Terraform interview questions cover both.
Supporting Tools
- Containers and orchestration: Docker, Kubernetes, Helm and Argo CD
- Pipelines: GitHub Actions, GitLab CI or Azure DevOps
- Observability: Prometheus, Grafana, OpenTelemetry and the provider's native monitoring
- Policy and security: Open Policy Agent, Checkov and cloud-native security posture tools
Certifications Worth Asking About
- AWS Certified Solutions Architect, Associate: 65 questions in 130 minutes, $150, valid for three years
- Microsoft Certified: Azure Administrator Associate (exam AZ-104): renewed every 12 months through a free online assessment
- Google Cloud Associate Cloud Engineer: two hours, $125, valid for three years, with six months of hands-on Google Cloud experience recommended
- Certified Kubernetes Administrator (CKA) from the CNCF and Linux Foundation, for engineers who run clusters
Certifications prove a baseline of service knowledge. They do not prove someone can design a network that survives an audit, so treat them as a filter, not a decision.
Cloud Engineer vs Adjacent Roles
Cloud job titles overlap heavily, and many US job posts use them interchangeably. The clearest way to separate them is by what each role is measured on:
- Cloud engineer: measured on a secure, reproducible and affordable cloud foundation. Owns accounts, networks, IAM and infrastructure-as-code across the whole estate.
- Cloud network engineer: a narrower specialist in VPC design, hybrid connectivity, routing and network security. Large estates have one; startups fold the work into the cloud engineer role.
- Cloud FinOps engineer: measured on cost. A FinOps engineer builds cost allocation, forecasting and savings programs, and works with finance as much as with engineering.
- DevOps engineer: measured on delivery speed. Owns CI/CD pipelines, release processes and developer tooling, and touches the cloud mainly through deployments.
- Platform engineer: measured on developer adoption. Builds an internal platform, often on Kubernetes, that product teams use as a self-service product.
- Infrastructure engineer: the broadest title, covering cloud, on-premises data centers, hardware and core systems. Common in companies that still run their own servers.
- Site reliability engineer: measured on uptime against service level objectives. Spends more time on observability, incident response and application reliability than on account structure.
- Serverless architect: designs event-driven applications on functions and managed services. A serverless architect works closer to application design than a cloud engineer does.
In an early-stage startup, one strong cloud engineer usually covers cloud, DevOps and basic SRE work. The split into separate roles comes with scale. Our platform vs DevOps vs infrastructure engineer comparison goes deeper on those three.
How to Hire a Cloud Engineer
The most common hiring mistake is testing service trivia. Candidates can memorize what each AWS service does.
Fewer can explain why a private subnet still cannot reach the internet, or how to recover when a Terraform state file is corrupted.
A practical interview loop:
- Architecture conversation (45 minutes): give a real scenario, such as a SaaS product moving from one account to a multi-account setup with SOC 2 in view, and ask for the account layout, network design and IAM model
- Infrastructure-as-code review (45 minutes): hand over a Terraform module with planted problems, such as a public bucket, a hardcoded secret and no state locking, and ask the candidate to review it as a pull request
- Troubleshooting exercise (30 minutes): a service cannot reach its database after a change. Watch how the candidate narrows the problem through security groups, routes, DNS and IAM
- Cost question (15 minutes): show a monthly bill with a 40 percent jump and ask where they would look first
Strong signals: they ask about compliance and budget before drawing a diagram, they explain trade-offs instead of naming services, and they have broken production before and can describe what they changed afterward.
Our AWS interview questions and Kubernetes interview questions give question banks for each area.
Second Talent helps US startups hire vetted AI-Native Engineers and Specialists from Asia, including cloud engineers and Kubernetes engineers.
Pricing is $29 to $39 USD an hour, billed monthly (160 hours is $4,599 to $5,999 a month), against the US salary benchmarks above.
You are matched with vetted candidates in 24 hours, engineers work with 4 to 6 hours of US time-zone overlap, there is no cost until you hire, and every hire carries a 90-day, one-time replacement guarantee.
Tell us the role you need to start.
Frequently Asked Questions
What does a cloud engineer do?
A cloud engineer designs, builds and runs a company's infrastructure on AWS, Azure or Google Cloud.
That covers account structure, networking, identity and access, compute, storage, and the infrastructure-as-code that creates it, plus cost control and incident support.
How much does a cloud engineer make in the US?
Indeed reports an average US base salary of $136,073 for cloud engineers (October 2026).
BLS has no cloud engineer category, but its closest occupations had May 2025 medians of $99,130 for network and computer systems administrators and $134,050 for computer network architects, with the top 10 percent of architects earning more than $202,680.
Is a cloud engineer the same as a DevOps engineer?
No, though the roles overlap. A cloud engineer owns the cloud foundation: accounts, networks, IAM and infrastructure-as-code. A DevOps engineer owns how software gets built and released, mainly CI/CD and developer tooling.
In small startups one engineer often does both.
Which certification is best for a cloud engineer?
Pick the provider you use. The AWS Certified Solutions Architect, Associate costs $150 and is valid for three years. Google Cloud's Associate Cloud Engineer costs $125 and is valid for three years.
Microsoft's Azure Administrator Associate (AZ-104) is renewed every 12 months through a free online assessment.
Should we use Terraform or OpenTofu?
Both use the same configuration language and most modules work with either. HashiCorp moved Terraform to the Business Source License in August 2023, and OpenTofu is the Linux Foundation fork that stays open source.
Teams that resell tooling or want an open-source license tend to choose OpenTofu. A cloud engineer who knows one can work in the other.
How much does it cost to hire a cloud engineer through Second Talent?
Second Talent charges $29 to $39 USD an hour, billed monthly, which is $4,599 to $5,999 a month for 160 hours.
You are matched with vetted cloud engineers from Asia in 24 hours, with 4 to 6 hours of US time-zone overlap, no cost until you hire and a 90-day, one-time replacement guarantee.
Related Roles
Explore related roles you can hire on Second Talent: Cloud Network Engineer, Cloud FinOps Engineer, DevOps Engineer, Platform Engineer, Site Reliability Engineer, Infrastructure Engineer.
