Cloud engineer

What does a cloud engineer do?

A cloud engineer builds and runs the cloud systems that applications depend on.

You set up servers, networks, storage and access rules on platforms such as Amazon Web Services (AWS), Microsoft Azure or Google Cloud.

In Singapore, the role sits in an IT, platform or infrastructure team. Banks, government agencies, telcos, software firms and IT consultancies all hire for it. The official SSOC occupation title is cloud specialist.

You work with software developers, security analysts, network engineers and the business teams that own the applications. You also deal with cloud vendors and managed service partners.

What the work involves

• Deploy and configure cloud resources such as virtual machines, networks, databases and storage.
• Write scripts and infrastructure code so that environments are built the same way every time.
• Automate routine operations like patching, backups, scaling and monitoring alerts.
• Set up proofs of concept and demonstrations of cloud solutions for project teams and business users.
• Administer and maintain servers across virtual platforms, and fix faults when systems slow down or fail.
• Review existing cloud setups and suggest changes that improve reliability, security or running cost.

Pay in Singapore

Back to top

Skills a cloud engineer needs

Back to top

Cloud engineer job description

We are hiring a cloud engineer to deploy, automate and maintain our cloud infrastructure in Singapore.

You will work with development, security and operations teams to keep applications available, secure and cost-aware. You will write infrastructure code, support releases and help the team improve how cloud services are run.

Responsibilities

• Deploy and configure cloud services on AWS, Azure or Google Cloud according to agreed designs.
• Write and maintain infrastructure as code using tools such as Terraform.
• Automate operational tasks with scripts and pipelines.
• Build, run and troubleshoot containers and Kubernetes clusters.
• Manage identity, access and network rules so that workloads follow security policy.
• Set up monitoring, logging and alerts, and respond to incidents.
• Maintain Linux and other servers across virtual platforms, including patching and backups.
• Run proofs of concept and demonstrations of new cloud solutions.
• Track cloud spending and recommend ways to reduce waste.
• Write runbooks and design notes so that other team members can support the systems.

Requirements

• A diploma or degree in computer science, information technology, engineering or a related field, or equivalent hands-on experience.
• Typically 1 to 3 years of experience in infrastructure, systems administration or cloud operations for a mid-level role. Entry roles may accept fresh graduates with projects or certifications.
• Working knowledge of at least one major cloud platform, often backed by an AWS or Azure certification.
• Practical skills in Linux, networking basics, Terraform or a similar tool, and a scripting language such as Python or Bash.
• Familiarity with Docker and Kubernetes, and an understanding of cloud security basics.

Back to top

Cloud engineer career path

Cloud engineers usually start in support or junior operations roles and grow towards design and platform leadership.

Moves between levels depend on the breadth of platforms you can run and the size of the systems you own.

1. Junior cloud engineer

   Entry

   You deploy resources from existing templates, handle tickets and monitor systems while a senior engineer reviews your work.

2. Cloud engineer

   Mid

   You own deployments and automation for one or more applications, write infrastructure code and respond to incidents on your own.

3. Senior cloud engineer

   Senior

   You design cloud setups, set standards for the team, guide security and cost decisions and coach junior engineers.

4. Cloud architect or platform lead

   Lead

   You decide the technical direction for cloud use across projects and lead a team that runs the shared platform.

5. Head of cloud or infrastructure

   Head

   You are accountable for cloud strategy, vendor relationships, budgets and risk across the organisation.

The titles are ones commonly used in Singapore; employers may name the levels differently.

Related jobs and their pay

Back to top

Cloud engineer interview questions

We wrote these questions from the skills this job needs. They are not an official question bank.

1. Explain the difference between IaaS, PaaS and SaaS. Give one example of each from a cloud platform you have used.

   What a good answer covers

   • Defines each model by what the provider manages and what you manage
   • Gives correct examples, such as virtual machines, a managed database or app platform, and a hosted email service
   • Explains how responsibility for patching and security changes across the models
   • Links the choice to cost, control and speed for a real workload

2. How would you design a network for a three-tier web application, with public and private subnets?

   What a good answer covers

   • Places load balancers in public subnets and app and database tiers in private subnets
   • Explains route tables, internet and NAT gateways, and security groups or firewall rules
   • Spreads resources across availability zones for resilience
   • Describes how administrators reach private servers safely, for example through a bastion host or managed access service

3. What is Terraform state, and how do you manage it when several engineers work on the same infrastructure?

   What a good answer covers

   • Explains that state maps code to real resources
   • Uses a remote backend with locking instead of local files
   • Keeps secrets out of code and protects the state file
   • Splits state by environment or component to limit the impact of a mistake
   • Reviews plans before applying changes

4. How do you apply least privilege for users and services in AWS IAM or Azure role-based access control?

   What a good answer covers

   • Gives each role only the permissions the task needs
   • Uses roles and groups instead of per-user permissions
   • Prefers temporary credentials over long-lived keys for services
   • Reviews access regularly and turns on multi-factor authentication for people
   • Uses logs to check what permissions are actually used

5. A Linux server is running out of disk space and an application is failing. How do you find and fix the cause?

   What a good answer covers

   • Checks usage with commands such as df and du to find the largest directories
   • Looks for runaway logs, old backups or temporary files
   • Frees space safely and confirms the application recovers
   • Sets log rotation and disk alerts to prevent a repeat
   • Considers resizing the volume if growth is genuine

6. What is the difference between a container and a virtual machine? How do you keep a Docker image small and safe?

   What a good answer covers

   • Explains that containers share the host kernel while virtual machines run their own operating system
   • Uses minimal base images and multi-stage builds
   • Avoids running as root and keeps secrets out of the image
   • Scans images for known vulnerabilities and pins versions

7. A Kubernetes pod is stuck in CrashLoopBackOff. Walk through how you would investigate.

   What a good answer covers

   • Checks pod events and status with kubectl describe
   • Reads container logs, including those of the previous run
   • Looks for bad configuration, missing secrets, failed health probes or memory limits
   • Tests a fix and confirms the pod stays healthy
   • Notes the cause in a runbook

8. How do you detect and deal with configuration drift between your Terraform code and what is running in the cloud?

   What a good answer covers

   • Runs plan on a schedule or in a pipeline to spot differences
   • Explains why manual console changes cause drift
   • Decides whether to update the code or revert the resource
   • Limits console write access and requires changes through code review

9. How would you use an AI coding assistant such as Claude Code to write Terraform, and how do you check what it produces?

   What a good answer covers

   • Gives clear context such as naming rules, modules and target environment
   • Reads every change and runs formatting, validation and plan before applying
   • Checks for open security groups, broad permissions and hard-coded secrets
   • Keeps real credentials and customer data out of prompts
   • Keeps a human reviewer in the pull request process

1. A release goes out on Friday evening and the website starts returning errors. What do you do in the first hour?

   What a good answer covers

   • Confirms the impact and tells the incident lead and stakeholders
   • Checks recent changes, dashboards and logs
   • Rolls back first if that is the fastest way to restore service
   • Keeps a timeline of actions taken
   • Follows up with a review that looks at process and fixes, and leaves out blame

2. Your team's monthly cloud bill has nearly doubled. How do you find the cause and bring it down?

   What a good answer covers

   • Breaks down cost by service, account and tag in the billing tools
   • Looks for idle resources, oversized instances, unattached storage and heavy data transfer
   • Checks whether a recent deployment or test environment caused the jump
   • Proposes fixes such as rightsizing, schedules to switch off non-production systems and budget alerts
   • Agrees changes with the application owners before acting

3. A developer asks you to make a storage bucket public so a partner can download files quickly. How do you respond?

   What a good answer covers

   • Asks what data is in the bucket and who needs access
   • Explains the risk of public exposure
   • Offers safer options such as time-limited signed links or scoped access for the partner
   • Checks logging and encryption settings
   • Records the decision and the approval

1. Tell me about a time a change you made caused a problem in a live system. What happened afterwards?

   What a good answer covers

   • Describes the situation and impact honestly
   • Explains how you found the cause and restored service
   • Names what changed afterwards, such as a test, approval step or alert
   • Takes ownership and gives others fair credit

2. Describe a time you explained a cloud design choice to people who are not technical. How did you make it clear?

   What a good answer covers

   • Starts from the business need, such as cost, risk or delivery date
   • Uses simple words and a simple diagram
   • Presents options and trade-offs
   • Checks that the audience understood and records the decision

1. Your application stores customer personal data in the cloud. What do you consider under the Personal Data Protection Act (PDPA) when choosing a region and setting controls?

   What a good answer covers

   • Knows the PDPA requires reasonable security arrangements and has rules for transferring data outside Singapore
   • Chooses the region with the data owner and legal or compliance team
   • Uses encryption, access control and logging
   • Plans for data retention and deletion
   • Keeps the answer general and leaves the details to legal advice

2. You join a bank regulated by the Monetary Authority of Singapore (MAS). How does this change the way you run cloud systems?

   What a good answer covers

   • Knows MAS sets expectations on technology risk management and outsourcing, including for cloud
   • Expects stricter change control, access reviews and audit logs
   • Plans for resilience, backups and tested recovery
   • Works with risk, compliance and internal audit teams
   • Says the exact requirements come from the bank's current policies and MAS guidance

Common questions about a cloud engineer job

Sources