Train your engineering and security teams to attack, defend, and automate AWS, Google Cloud, and Kubernetes in 2 days.

Most cloud trainings waste your team's time with 200 slides of generic compliance theory. You won't get that here. In this 2-day hands-on bootcamp, your engineers work inside live cloud environments. We break real misconfigurations, wire up native detection platforms, prioritize vulnerabilities that actually matter, and deploy kernel-level runtime security.

Who it's for: Cloud Engineers, DevSecOps, Platform Teams, SREs, and Security Engineers (up to 12 participants per cohort).

Tailored to your stack: I customize the labs to the platforms you run in production (AWS, Google Cloud, Kubernetes, and CNAPP). If you don't use a tool, we don't waste an hour on it.

Who teaches it: Delivered live by me, Alexander Hose (2x Published Cloud Security Author, Google Developer Expert, Wiz MVP, and AWS Community Builder).

Get the Syllabus & Check Dates 📧

What Your Team Gets in 48 Hours

1. Attacker + Defender Perspective 💻

Your engineers build better defenses when they see how an exploit actually works. You'll extract credentials from instance metadata endpoints, abuse IAM trust policies, and immediately deploy the guardrails that shut those paths down

2. Signal Over Alert Noise 🎯

Turning on cloud security tools is easy. Dealing with 10,000 findings is where you get stuck. I'll show your team how to configure GuardDuty, Security Hub, GCP Security Command Center, and CNAPP attack paths so you fix real choke points first

3. Kernel-to-Cloud Runtime Visibility 🛡

Static scanners can't see what happens inside a running container. Your team deploys Cilium Tetragon (eBPF) on Kubernetes and ships live runtime security alerts straight into Amazon CloudWatch or Google Cloud Logging

4. Working Code & Lab Playbooks 📦

You don't leave with a PDF certificate. Every participant keeps my full lab repository, IAM policy templates, Kubernetes TracingPolicies, Vector log pipelines, and an open-source AI patching agent you can adapt for your own environment

2-Day Bootcamp Curriculum 🎓

1
Day 1 · Morning

Cloud Identity (IAM) & Instance Metadata Exploitation (IMDS)

We start where most cloud breaches begin: Identity. Your team will exploit live instances and then lock down the exact paths we used:

  • Exploit EC2 and Compute Engine instances via the Instance Metadata Service (AWS IMDSv1/IMDSv2 and the GCP Metadata Server).
  • Trace how SSRF and application flaws lead to IAM role and service account token theft.
  • Lock down identity boundaries with IAM Access Analyzer, AWS Service Control Policies (SCPs), and GCP Organization Policies.
  • Replace static keys in CI/CD pipelines with keyless OIDC and Workload Identity Federation.
2
Day 1 · Afternoon

Threat Detection, Attack Paths & Vulnerability Prioritization (CVSS, KEV, EPSS)

With over 37,000 new CVEs published per quarter and only 1.17% actively exploited in the wild, patching solely by CVSS Base Score breaks engineering sprints:

  • Configure AWS GuardDuty and AWS Security Hub v2 or Google Cloud Security Command Center for organization-wide threat detection and native attack path analysis.
  • Move beyond raw CVSS Base Scores by combining CISA KEV (Known Exploited Vulnerabilities) and EPSS (Exploit Prediction Scoring System).
  • Use graph-based attack path analysis (Security Hub v2, GCP SCC, and Wiz) to correlate vulnerabilities with public exposure, open firewall rules, and IAM privileges.
3
Day 2 · Morning

Safe Remediation Workflows & AI Security Agents (AWS & GCP)

Nobody wants a script or an AI agent running blind upgrades in production and crashing services. In this module, we build safe, human-gated automation tailored to your cloud provider:

  • Design multi-agent triage and remediation workflows using Amazon Bedrock Agents / AWS Systems Manager (SSM) on AWS or Google ADK / OS Config on GCP (using my open-source PatchAdvisor architecture).
  • Build a patching loop: snapshot the volume or boot disk first, apply updates to a non-production canary instance, and verify CloudWatch or Cloud Logging health before promoting to production.
  • Automate instant rollbacks and posture fixes (security groups, VPC firewall rules, and instance metadata hardening) via agent tool calls.
4
Day 2 · Afternoon

Kubernetes Runtime Security with eBPF (Cilium Tetragon to CloudWatch & Cloud Logging)

Static image scanning can't see an attacker running a shell inside a live pod. In this lab, we move into the Linux kernel:

  • Deploy Cilium Tetragon as an eBPF DaemonSet on Kubernetes to monitor process executions, file access, and network sockets without sidecars.
  • Write custom Kubernetes TracingPolicy rules to detect and block unauthorized binaries in real time.
  • Build a log pipeline with Vector to parse, enrich, and ship structured Tetragon security alerts directly to Amazon CloudWatch or Google Cloud Logging.

How the Workshop Works

Format
2-Day Hands-On Bootcamp

Also available as a 1-day intensive or half-day executive briefing.

Group Size
Up to 12 Engineers

Small enough for direct 1-on-1 lab support and architecture Q&A.

Delivery
Onsite

At your office across Germany, DACH & Europe.

Languages & Stack
English or German

Labs tailored before Day 1 to your AWS, GCP, or Kubernetes setup.

Book a Workshop for Your Team

I only run a limited number of private corporate workshops each quarter. Send me a short message with your cloud stack and preferred month to check availability and get the detailed syllabus:

📧 Email: me[at]alexanderhose.com

🔗 LinkedIn: https://www.linkedin.com/in/alexanderhose/

📍 Location: Frankfurt am Main, Germany (Onsite across Europe)