Cloud engineer career path: from junior engineer to cloud architect
Each step up the cloud ladder, from junior cloud engineer through senior cloud engineer to cloud architect, principal cloud architect or head of cloud: what changes in the job, the gap to close, how to show it on your CV and in interviews, and a plan.
The cvscored team
Contents
The ladder at a glance
| Step | What you are measured on next | Typical time |
|---|---|---|
| Junior cloud engineer to cloud engineer | Changes you design and ship alone, safely | 1 to 2 years |
| Cloud engineer to senior cloud engineer | Platforms other teams depend on | 2 to 4 years |
| Senior cloud engineer to cloud architect | Designs and standards across many teams | 2 to 4 years |
| Cloud architect to principal cloud architect | The cloud direction of the whole company | After several large designs |
| Cloud architect to head of cloud | The cloud team, its budget and the provider contracts | After leading people |
This ladder has three neighbours. DevOps engineers arrive at cloud architect from the delivery side, through platform and SRE work; their steps are on the DevOps engineer career paths. Above principal cloud architect, the general architecture steps, such as enterprise architect, are on the software architect career paths. Cloud engineers who turn to security follow the security engineer career paths up to security architect.
Engineers who care most about how cloud services behave under load and in incidents may follow the reliability road instead, described on the site reliability engineer career paths.
Cloud engineers who build landing zones and shared clusters for many teams are close to platform engineering; the steps of that role, up to head of platform, are on the platform engineer career paths.
Cloud work that starts with a customer's problem and ends in a design for a project belongs to solutions architects; their steps up to head of solutions architecture are on the solutions architect career paths.
From junior cloud engineer to senior
Junior cloud engineer to cloud engineer
What changes: you take a change from request to production on your own: write the code, read the plan, get the review, roll it out and watch it. You join the on-call rota with a senior behind you.
The gap: one provider in depth, AWSAsked in 52% of cloud engineer ads (as of 5 Nov 2026).Accounts and organisations, identity and roles, networks, compute, storage and managed databases, and the bill. depends on the provider, AzureAsked in 47% of cloud engineer ads (as of 5 Nov 2026).Subscriptions and management groups, Entra ID for identity, virtual networks, policies and the cost reports. depends on the provider or Google CloudAsked in 25% of cloud engineer ads (as of 5 Nov 2026).Projects and folders, identity and access, networks, compute and the managed services teams build on. depends on the provider, identity and networksAsked in 15% of cloud engineer ads (as of 5 Nov 2026).Address ranges, subnets, routing, firewalls, private links, DNS and the link to the company's own sites., TerraformAsked in 40% of cloud engineer ads (as of 5 Nov 2026).Write and review modules, keep state safe, plan before apply, and find drift between the code and the cloud. with remote state, LinuxAsked in 26% of cloud engineer ads (as of 5 Nov 2026).Most cloud servers and containers run Linux: users, services, logs, disks and the network from the shell. and a scripting language such as PythonAsked in 27% of cloud engineer ads (as of 5 Nov 2026).Scripts and small tools against the providers' APIs: reports, clean-ups, checks and glue for pipelines..
On the CV and in interviews: the services you set up, the modules you wrote and an incident you helped to solve. Expect a network to draw and a plan output to read.
Plan (6 to 12 months): build a small environment from nothing in code, including identity, network, a workload and its backups; take over one module and its tests; shadow two incidents and write their timelines; take a provider's associate-level course if it helps you learn.
Cloud engineer to senior cloud engineer
What changes: you own a part of the platform that other teams depend on, such as the landing zone, the network hub or the container platform. You review others' changes, lead incidents and say no when a request would hurt security or cost.
The gap: platform design, KubernetesAsked in 60% of cloud engineer ads (as of 5 Nov 2026).Run workloads on a managed cluster: deployments, scaling, networking, secrets and upgrades of the cluster. or the provider's container service, policy as code, disaster recovery you have tested, cost reports, and securityAsked in 14% of cloud engineer ads (as of 5 Nov 2026).Identity first, least privilege, encryption, logging and quick patching; know the common cloud misconfigurations. you can defend in an audit.
On the CV and in interviews: a platform you built that teams use, its size, and what got safer, faster or cheaper. Expect a design question with a budget and a recovery target.
Plan (12 to 24 months): own one shared service end to end; lead a disaster recovery test; cut a cost line with the teams that cause it; mentor a junior through their first on-call week.
Cloud architect, principal architect and head of cloud
Senior cloud engineer to cloud architect
What changes: you design more than you build. You set the patterns teams follow: account structure, networks, identity, data placement, recovery levels and the choice of services, and you write the decisions down so they last.
The gap: trade-offs written for people who do not read code, rules of regulators and auditors, explaining designsAsked in 20% of cloud engineer ads (as of 5 Nov 2026).Explain a design, its risk and its cost to developers, security and finance in plain words. to managers and finance, and enough breadth to compare providers fairly.
On the CV and in interviews: a design several teams built on, a decision record you wrote and how it held up. Expect a case: a regulated product moving to the cloud with a recovery target and a budget.
Plan (12 to 24 months): run the design reviews for new workloads; write the reference architecture for one common kind of system; present a cost and risk comparison of two options to leadership.
Cloud architect to principal cloud architect
What changes: your view is the whole company: which provider for what, the exit plans for critical systems, the standards across business units, and the cloud's part in the technology strategy. You lead other architects without managing them.
The gap: strategy on paper, contract and licence questions, influence across departments, and a record of large migrations or platforms that worked.
On the CV and in interviews: a strategy you wrote and what changed because of it, money or risk measured at company level. Expect to defend a provider choice in front of a board-level question.
Plan (several years): own the cloud strategy document; lead the architecture of one large programme; build a group of architects who review each other's work.
Cloud architect to head of cloud
What changes: you run the cloud function: the teams, hiring, the budget, the contracts with providers, and the service the platform gives to developers. You report to the head of infrastructure, the CIO or the CTO.
The gap: leading leadsAsked in 4% of cloud engineer ads (as of 5 Nov 2026).Lead a cloud team: standards, reviews, on-call that is shared fairly, and juniors who grow., budgets and forecasts, negotiations with providers, and goals leadership understands, such as cost per product, availability and time to a new environment.
On the CV and in interviews: the team and budget you led, a platform others adopted, and cost or risk you changed. Expect a case: spend is rising faster than revenue; what do you do in the first ninety days?
Plan (several years): line-manage other leads; own the cloud budget for a year; run a contract renewal with a provider; find a mentor who already runs an infrastructure department.
Two roads continue from here on other pages. The general architecture steps above principal level are described for software architects, and the steps to security architect and CISO for security engineers; both pages are linked at the top of this one.
Your CV for the next step
Moving up in the cloud shows on a CV as a wider reach: from resources you built, to a platform teams use, to decisions a company runs on. Three rules:
- Leave every past title exactly as it was. Let the lines below it show the size of what you ran.
- Speak the next level's language. Senior ads say "platform", "landing zone", "on-call"; architect ads say "reference architecture", "design decisions", "governance"; head ads say "budget", "team", "provider contracts".
- Tie a figure to every line. Teams served, time to a new environment, recovery time, cost.
| Skill | Weak line | Strong line, with proof |
|---|---|---|
| Cloud team leadAsked in 4% of cloud engineer ads (as of 5 Nov 2026).Lead a cloud team: standards, reviews, on-call that is shared fairly, and juniors who grow. | Led the cloud team. | Led 6 cloud engineers serving 40 product teams; time to a new environment fell from three weeks to one day. |
| Reference architecture | Defined cloud standards. | Wrote the reference architecture for customer-facing services; 12 teams adopted it in the first year. |
| Provider strategy | Worked on the cloud strategy. | Wrote the exit plans for the five most critical systems as the financial regulator asked; accepted with no findings. |
| PlatformAsked in 47% of cloud engineer ads (as of 5 Nov 2026).Subscriptions and management groups, Entra ID for identity, virtual networks, policies and the cost reports. depends on the provider | Built a cloud platform. | Built the Azure platform for the group's data teams with policies and budgets built in; no team works outside it. |
Key takeaways
- The ladder goes junior cloud engineer, cloud engineer, senior, cloud architect, then principal or head of cloud.
- Senior means owning a platform others depend on; architect means setting the patterns they follow.
- DevOps engineers reach cloud architect by their own road; the two career pages link to each other.
- Enterprise architecture and security leadership continue on the software architect and security engineer pages.
- Show each step with a wider reach and a figure, under the job where it happened.
Frequently asked questions
- What comes after senior cloud engineer?
- Cloud architect for design across teams, then principal cloud architect or head of cloud, depending on whether you want strategy or people and budget.
- Do I need a certification to become a cloud architect?
- No law asks for one. Ads for architects ask mostly for designs you led; a provider's architect certification is one way to show breadth.
- How is a cloud architect different from a solution architect?
- A cloud architect designs the platform and its rules; a solution architect designs one system for a business need, often on that platform. Titles overlap between companies.
- Can I move up without managing people?
- Yes. Principal cloud architect is a senior step without a team; head of cloud is the management road.
- What should my CV show for a cloud architect role?
- Designs others built on, decisions you wrote and defended, and the cost, risk or speed they changed.