Four skills carry most of the weight in cloud hiring: cloud architecture, infrastructure as code, containers and Kubernetes, and automation. Certifications prove you studied them. Being able to demonstrate them is what actually converts an interview. This note breaks each one into what to learn, what to build, and which lab to start with.
🧭 Why these four and not ten
I have trained a lot of people who collected three or four certifications and still could not get past a technical screen. The pattern is consistent enough to name: certifications get you the interview, demonstrated skill gets you the offer, and these four skills are what the demonstration is made of.
They were picked on two criteria:
- 📋 They appear together in job postings. Not occasionally. Read twenty mid-level cloud engineer postings and you will see all four in most of them.
- 🧱 They compound. IaC is more useful once you understand architecture. Containers are more useful once you can automate them. Learning them in this order is deliberate.
If you only have time for one this year, make it infrastructure as code. It is the single skill that most reliably separates "I clicked through the portal" from "I can be trusted with production."
1️⃣ Cloud Architecture
Understanding how compute, storage, networking, databases, and identity fit together - and why a design fails when one of them is wrong.
This is the skill people skip because it has no obvious "build" step. It is also the one that shows up hardest in interviews, because architecture questions are how interviewers find out whether you understand the platform or just memorized service names.
📘 What to actually learn
| Area | What you need to be able to do |
|---|---|
| Networking | Design VNets and subnets, explain NSGs vs firewalls, know when a private endpoint is required |
| Identity | Managed identity over secrets, RBAC scope and inheritance, least privilege in practice |
| Compute choice | Justify VM vs App Service vs Containers vs Functions for a given workload |
| Storage and data | Pick a storage tier, know when a relational database beats a document store |
| Reliability | Availability zones, backup and restore, what your RTO and RPO actually are |
| Cost | Estimate a design before building it and explain the trade-offs |
🎯 The interview test
You can consider this skill real when you can whiteboard a three-tier application on a cloud platform, explain every arrow, and answer "what happens when this component fails?" for each box.
Create and Configure VNets and Subnets
Networking is the foundation of cloud architecture and the area most self-taught engineers are weakest in. Start here.
🎓 Certifications
AZ-104 covers the operational half. AZ-305 covers the design half and is the stronger architecture signal. On the AWS side, Solutions Architect Associate.
2️⃣ Infrastructure as Code
Building and managing infrastructure through code instead of clicking through a portal.
If I could only teach one skill from this list, it would be this one. Every serious cloud team runs on it, portal-only candidates get filtered out early, and it is the skill where a portfolio speaks loudest, because your Terraform is right there on GitHub for anyone to read.
📘 What to actually learn
| Area | What you need to be able to do |
|---|---|
| Core syntax | Resources, variables, outputs, data sources |
| State | What state is, why remote state matters, how to not corrupt it |
| Modules | Factor repeated infrastructure into something reusable |
| Plan and apply discipline | Read a plan properly before applying it |
| Drift | Detect and reconcile changes made outside code |
| Secrets | Keep credentials out of state files and repos |
The mistake almost everyone makes early: storing Terraform state locally, then losing it or committing it. Set up a remote backend on day one. State containing secrets in a public repo is a genuine incident, not a learning moment.
🧪 Labs, in order
| Lab | What it teaches |
|---|---|
| Intro to Azure Terraform | Syntax, providers, first apply |
| Terraform Azure Backend | Remote state, the thing everyone skips |
| Terraform Modules Intro | Reuse and structure |
| Terraform Azure VM | A real resource end to end |
Introduction to Azure Terraform
Start here if you have never written a line of HCL. Provider setup, your first resource, and a real apply against your own subscription.
🎓 Certifications
HashiCorp Terraform Associate is well regarded and genuinely tests the tool. If you are Azure-only, the Bicep path is a reasonable alternative, though Terraform travels further across employers.
3️⃣ Containers and Kubernetes
How modern applications get packaged, deployed, scaled, and managed.
Containers are close to universal now. Kubernetes is not universal, but it is common enough at mid-size and larger companies that not knowing it closes doors. Learn containers properly first. Kubernetes on top of a shaky container foundation is misery.
📘 What to actually learn
| Stage | What you need to be able to do |
|---|---|
| Docker fundamentals | Write a Dockerfile, build, tag, and push an image |
| Image hygiene | Multi-stage builds, small base images, no secrets baked in |
| Registry | Push to and pull from a private registry |
| Managed containers first | Container Apps or ACI before you touch Kubernetes |
| Kubernetes core | Pods, deployments, services, ingress, configmaps, secrets |
| Operating it | Scaling, health probes, resource limits, reading logs and events |
A lot of workloads people put on Kubernetes belong on Azure Container Apps or ECS. Being able to explain when Kubernetes is the wrong answer is itself a senior signal in interviews.
🧪 Where to practise
| Resource | Covers |
|---|---|
| Write Dockerfiles and Build Custom Images | Docker fundamentals, start here |
| Container Apps with Docker Hub Images | Managed containers, the sensible next step |
| Azure Container Registry | Private registries |
| Create and Debug Your First Pod with kubectl | Kubernetes, from the ground up |
| Cluster DNS and Service Discovery | How pods actually find each other |
Create, Inspect and Debug Your First Pod with kubectl
Kubernetes starts making sense the moment you break a pod and have to work out why. Do this in a real cluster rather than reading about it.
🎓 Certifications
CKA (Certified Kubernetes Administrator) is the recognized standard and is fully hands-on, which makes it a genuine skill signal. KCNA is the gentler entry point.
4️⃣ Cloud Automation
CI/CD, scripting, and the pipeline that moves code from a commit to production.
The skill that ties the other three together. Architecture designs it, IaC defines it, containers package it, and automation ships it. Teams feel the absence of this skill immediately, which is why it is on nearly every posting.
📘 What to actually learn
| Area | What you need to be able to do |
|---|---|
| A pipeline tool | GitHub Actions or Azure DevOps, one of them properly |
| Build and test stages | Fail the pipeline before bad code reaches an environment |
| Deployment | Deploy to a real environment from the pipeline, not your laptop |
| Secrets in pipelines | OIDC and federated credentials over long-lived secrets |
| Environments and approvals | Dev to prod promotion with a gate |
| Scripting | Bash or PowerShell, plus the CLI for your cloud |
Do not use a service principal secret pasted into pipeline variables. Use OIDC and federated identity credentials. Long-lived cloud credentials sitting in CI is one of the most common real-world breach paths, and interviewers do ask about it.
🧪 Where to practise
| Resource | Covers |
|---|---|
| Containerized Apps to Azure with GitHub Actions | Full build and deploy pipeline |
| Azure CLI Essentials | The scripting foundation |
| Azure Automation Account Basics | Scheduled operational automation |
Deploy Containerized Applications to Azure with GitHub Actions
Build, push, and deploy from a real pipeline. This single lab covers containers and automation together, which is exactly how they appear in the job.
🎓 Certifications
AZ-400 DevOps Engineer Expert is the direct match, though it expects AZ-104 or AZ-204 first. GitHub Actions certification is a smaller, faster credential that covers the pipeline half.
🗓️ A realistic 6-month order
Do not run these in parallel. Each builds on the last.
| Months | Focus | Finish with |
|---|---|---|
| 1 to 2 | Cloud architecture | A three-tier design you can whiteboard and defend |
| 3 | Infrastructure as code | That same design, built entirely in Terraform |
| 4 | Containers | Your app containerized and running on managed containers |
| 5 | Automation | A pipeline that deploys it all on every commit |
| 6 | Kubernetes, or go deeper | Only if your target roles ask for it |
By month six you have not just four skills. You have one coherent project that demonstrates all of them, which is worth considerably more than four separate tutorials.
📋 The whole thing on one page
| Skill | Prove it by | First lab | Cert |
|---|---|---|---|
| Cloud Architecture | Whiteboarding and defending a design | VNets and Subnets | AZ-104, then AZ-305 |
| Infrastructure as Code | A Terraform repo on GitHub | Intro to Azure Terraform | Terraform Associate |
| Containers and K8s | A containerized app running in the cloud | Dockerfiles, then first pod | CKA |
| Cloud Automation | A working CI/CD pipeline | GitHub Actions deploy | AZ-400 |
CloudLearn: all four skills, in one place
Every lab linked in this note is on CloudLearn, sequenced across the same four areas. Real Azure environments in the browser, so you can practise the architecture, Terraform, container, and pipeline work without spending your own credits.
🔗 Where to go next
- 4 Projects That Make a Cloud Resume Impossible to Ignore - the build targets for these four skills
- 5 AI Jobs You'll See More of in 2027 - where these skills lead if you add AI
- Azure Cloud Learning Roadmap - the full lab-by-lab path
Want this mapped to your actual situation?
Six months is the honest timeline, but the right order depends on what you already know and what roles you are targeting. Tell me where you are starting from and I will map it out with you.
