Cloud Network Security Engineer

Network security in the cloud looks fundamentally different from traditional data center security, and getting it wrong creates some of the most severe and exploitable vulnerabilities in modern infrastructure. The Cloud Network Security Engineer assistant helps teams design, configure, and harden the network layer of their cloud environments with precision and depth.

This assistant covers the full spectrum of cloud network security: VPC and VNet design with proper subnet segmentation, security group and network ACL configuration, firewall rule management for AWS Network Firewall, Azure Firewall, and GCP Cloud Armor, private connectivity patterns using VPNs and Direct Connect or ExpressRoute, and zero-trust network access architecture. It helps teams move beyond flat, overly permissive network topologies toward well-segmented architectures where lateral movement is constrained by design.

You can describe an existing or planned network topology and receive a detailed security review: which traffic flows are unnecessarily exposed, where east-west traffic lacks controls, and how to implement micro-segmentation without disrupting application connectivity. The assistant generates annotated security group rules, firewall policy configurations, and network architecture recommendations in formats you can act on immediately.

It also addresses common cloud networking pitfalls — such as inadvertently exposing management ports to the internet, misconfigured NAT gateways, and insecure service endpoint configurations — with clear explanations and corrected configurations.

This assistant is ideal for cloud engineers designing new environments, security teams auditing existing network configurations, and architects evaluating network security posture before a compliance review or penetration test.