Cloud Security Engineering and Social Science

Cloud security engineering is a technical career, but a lot of the job also involves
understanding people and how they interact with technology. A cloud security engineer helps
protect cloud-based systems, applications, and data from unauthorized access, attacks, and other
security risks. Some of the work can include managing access controls, monitoring cloud
systems, identifying vulnerabilities, responding to security incidents, and making sure security
policies are being followed. Cloud computing also creates security and privacy concerns because
an organization may store its data and applications on infrastructure managed by a cloud
provider instead of keeping everything inside its own network (Jansen & Grance, 2011). Because
people use, manage, and make decisions about these systems, social science is connected to
cloud security in several ways.
One social science concept that applies to cloud security engineering is human behavior.
Cybersecurity incidents are not always caused by a hacker directly defeating a technical security
control. Employees can accidentally expose information, use weak passwords, approve a fake
request, or fall for phishing and other social engineering attacks. Research on human factors in
cybersecurity shows that people should not only be viewed as security weaknesses. Employees
can also become an important part of an organization’s defense when security responsibilities,
training, and expectations are clearly established (Colabianchi et al., 2025). For a cloud security
engineer, this means security systems should be designed with normal human behavior in mind.
Controls such as multifactor authentication, least-privilege access, automated policies, and
security monitoring can reduce the amount of damage that can happen when someone makes a
mistake.
Another concept that relates to cloud security is organizational culture. The way
employees approach cybersecurity can be influenced by managers, coworkers, workplace
expectations, and the way security policies are enforced. Sutton and Tompson (2025) found that
cybersecurity culture is connected to employee attitudes, policy compliance, security education,
management support, and shared expectations about security. This matters because cloud
security engineers normally work with more than just the security department. They may work
with developers, system administrators, managers, and employees who have different levels of
technical knowledge. Even a strong security control may not work as intended if employees do
not understand why it exists or regularly find ways around it because it interferes with their
work.
A third concept is risk perception. People do not always judge cybersecurity threats the
same way. One employee may immediately recognize that a suspicious email could be
dangerous, while someone else may think there is little risk in opening it. These differences can
affect how people respond to cyber threats. This is especially important with social engineering,
which is another concept connected to the career. Social engineering attacks often take advantage
of human reactions such as trust, urgency, fear, or respect for authority instead of relying only on
technical weaknesses. Rocha Flores and Ekstedt (2016) found that employee attitudes, security
culture, awareness, and confidence in handling threats were related to employees’ intentions to
resist social engineering. A cloud security engineer has to consider these behaviors when setting
up access controls, authentication requirements, security alerts, and incident-response
procedures.
Cloud security engineering also connects to marginalization and inequality. People do not
have equal access to technology, reliable internet service, cybersecurity education, or technical
career opportunities. Layne et al. (2026) examined cybersecurity and digital equity in an
underserved, predominantly Black community and found that geography, socioeconomic status,
infrastructure, and digital skills can create barriers to digital participation and cybersecurity
knowledge. This creates several challenges. One challenge is that lower-income and underserved
communities may have fewer resources available for cybersecurity education and secure
technology. A second challenge is that differences in digital literacy can make complicated
security requirements harder for some people to understand or use. A third challenge is unequal
access to opportunities within the cybersecurity workforce itself.
Gender representation is one example of inequality within cybersecurity careers. Blum et
al. (2023) found that women can experience different barriers depending on their career stage.
Some of the concerns identified in the study included not knowing enough about cybersecurity
opportunities, feeling that women may be undervalued in a male-dominated field, and concerns
about workplace harassment. These issues are important because a lack of representation can
affect who enters the field and whose experiences are included when technology and security
decisions are made. For a cloud security engineer, understanding these differences is important
because security systems are used by people with different backgrounds, resources, abilities, and
levels of technical knowledge.
There is also a strong connection between cloud security engineering and society. Cloud
technology is used in areas such as education, healthcare, banking, government, communication,
and business. Because so many services depend on cloud systems, a security problem can affect
more than one computer or organization. A breach can expose private information, interrupt
important services, create financial losses, and affect people’s trust in the organization
responsible for their data. NIST explains that organizations still have responsibilities for security,
privacy, oversight, and risk management when they move data and services to public cloud
environments (Jansen & Grance, 2011). As society becomes more dependent on cloud services,
the work of cloud security engineers becomes more connected to the everyday lives of the people
who depend on those systems.
Overall, cloud security engineering is a career that requires more than technical
knowledge. Human behavior, organizational culture, risk perception, social engineering,
marginalization, and digital inequality can all affect cybersecurity. Understanding these social
science concepts can help cloud security engineers create security controls that work in real
organizations instead of only looking good from a technical point of view. The career also has a
direct connection to society because cloud systems now support many of the services people use
every day.

References
Blum, D., Dawson, J., & Malone, N. (2023). Barriers to a cybersecurity career: Analysis across
career stage and gender. Computers & Security, 132, 103316.
https://doi.org/10.1016/j.cose.2023.103316
Colabianchi, S., Costantino, F., Nonino, F., & Palombi, G. (2025). Transforming threats into
opportunities: The role of human factors in enhancing cybersecurity. Journal of Innovation &
Knowledge, 10(3), 100695.
https://doi.org/10.1016/j.jik.2025.100695
Jansen, W., & Grance, T. (2011). Guidelines on security and privacy in public cloud computing
(NIST Special Publication 800-144). National Institute of Standards and Technology.
https://doi.org/10.6028/NIST.SP.800-144
Layne, A., Liu, L., Akanaga, C., & Comert, G. (2026). Why race and place matter: Examining
the intersection of cybersecurity and digital equity. Journal of Black Studies, 57(1), 28–50.
https://doi.org/10.1177/00219347251358957
Rocha Flores, W., & Ekstedt, M. (2016). Shaping intention to resist social engineering through
transformational leadership, information security culture and awareness. Computers & Security,
59, 26–44.
https://doi.org/10.1016/j.cose.2016.01.004
Sutton, A., & Tompson, L. (2025). Towards a cybersecurity culture-behaviour framework: A
rapid evidence review. Computers & Security, 148, 104110.
https://doi.org/10.1016/j.cose.2024.104110