DEV Community: Sherdil IT Academy

The Cloud Engineer Salary Negotiation Playbook (Pakistan, 2026)

Sherdil IT Academy — Thu, 02 Jul 2026 10:10:56 +0000

Most cloud engineers in Pakistan lose the salary negotiation before it starts, and not because their skills are weak. They lose it because they treat the offer as a fixed number instead of a set of levers. The recruiter says a figure, the engineer says "okay," and thousands of rupees a month quietly disappear.

This is the practical playbook I wish someone had handed me earlier: the numbers to anchor to, the levers that still move after the base is "locked," and the exact lines to say. No theory, no motivation. Just the mechanics.

Step 1: Anchor to the market, not your last payslip

The single most expensive mistake is anchoring your ask to your current salary. Employers love it when you do, because a 20 percent bump on a low base is still a low base. Anchor to what the role pays in 2026 instead.

Level	Monthly base (PKR)	Remote (USD/mo)
Junior cloud engineer	60,000 to 130,000	800 to 1,500
Mid-level cloud/DevOps	130,000 to 280,000	1,500 to 3,000
Senior / platform	280,000 to 550,000	3,000 to 6,000

Walk in with a range, state the top of it first, and back it with evidence: certifications, a GitHub portfolio, and specific things you have shipped. When you name a number, stop talking. Silence is a tool, not a gap you need to fill.

Step 2: Know your levers before the call

"The base is fixed" is almost never the end of the conversation. It just means the money moved somewhere else. Here is the full menu of what is actually negotiable, roughly in order of how often it works:

Signing bonus. One-time cost, off the recurring payroll line, so approvals are easier.
Performance review at 3 to 6 months with a pre-agreed raise band written into the offer.
Remote or hybrid days, which is real money once you price in commute and time.
Certification and training budget (AWS, CKA, Terraform). Ask them to pay the exam fees.
Annual leave and flexible hours.
Title. A better title compounds into every future offer you ever get.
Equipment allowance for a laptop and a home-office setup.

The point: if you only negotiate base, you are playing one square on a board that has eight.

Step 3: The scripts

You do not need to be aggressive. You need to be specific and calm. Here are lines you can adapt word for word.

When they ask your expected salary first:

"Based on the market range for this role and my experience with [AWS, Kubernetes, Terraform], I am targeting PKR [top of your range]. I am open to discussing how we structure that."

When they say the base is fixed:

"I understand the base is set. In that case, can we look at a signing bonus and a documented performance review at six months? If the base cannot move now, I would like a clear path for it to move soon."

When they lowball you:

"That is below what I have seen for this scope of work in 2026. Help me understand what is driving the number, and let us see where there is room, whether that is base, bonus, or review timing."

When you already have another offer:

"I have another offer on the table, and I would genuinely prefer to work here. If we can close the gap on [base / bonus / remote days], I am ready to sign."

Never invent a competing offer you do not have. It is easy to get caught, and it ends the relationship. If you have one, use it plainly. If you do not, lean on the market data instead.

Step 4: Do the total-comp math

Two offers with the same base are rarely equal. Compare the whole package, not the headline number.

Lever	Offer A	Offer B
Monthly base	200,000	190,000
Signing bonus	0	150,000
Remote days/week	0	3
Cert budget	0	100,000/yr
6-month review	No	Yes

Offer B has the lower base and is clearly the stronger deal once you add the bonus, the saved commute, and the funded certifications. This is exactly the math most engineers skip, and it is where quiet money hides.

Step 5: Get it in writing

A verbal "we will sort the raise out later" is worth nothing. Once you agree on the terms, ask for the offer letter to state the base, the bonus, the review date, and the raise band. If it is not written, it did not happen. Polite, firm, and documented wins every time.

The mindset shift

Negotiating is not being difficult. Every good manager expects it, and many quietly respect the engineers who do it well because it signals you will advocate for the team and the budget too. The engineers who stay underpaid in Pakistan are almost never the least skilled. They are the ones who never ran the play.

I put the full framework, including the complete lever checklist, more scripts for tricky moments, and the total-comp calculator, into a Pakistan-specific guide over here: how to negotiate a cloud engineer salary in Pakistan.

What is the one lever you have never tried to negotiate: bonus, review timing, or remote days? Drop it in the comments. 👇

The Cloud Security Toolchain Every Engineer Should Know (2026)

Sherdil IT Academy — Sat, 27 Jun 2026 11:09:58 +0000

Cloud security interviews don't reward people who can define the shared-responsibility model. They reward people who've actually run the tools. So instead of theory, here's the practical toolchain I'd expect a working cloud security engineer to be comfortable with in 2026 - grouped by where it sits in the pipeline.

(Quick note on why this skill set is worth building: in markets like Pakistan, cloud security is currently the most underserved technical niche - regulators are forcing banks and fintechs to staff it, and the salary premium reflects how few people can actually do the work.)

1. Catch misconfigurations before they ship (IaC scanning)

Most cloud breaches start as a misconfiguration in a Terraform file, not a zero-day. Scan infrastructure-as-code in CI before it ever reaches an account:

Checkov
tfsec
Terrascan

# Scan a Terraform directory with Checkov
checkov -d ./infra

# Scan the same directory with tfsec
tfsec ./infra

Wire one of these into your pipeline so a misconfigured security group fails the build instead of reaching production.

2. Secure the containers and the cluster

Two different jobs here: scanning images for known vulnerabilities, and watching runtime behaviour.

Image scanning - Trivy, Snyk:

# Scan a container image for vulnerabilities
trivy image myorg/payments-api:latest

Runtime threat detection — Falco watches for suspicious syscalls inside running containers (a shell spawned in a container, unexpected writes to sensitive paths, etc.).

Kubernetes hardening is its own competency: RBAC done properly, PodSecurityAdmission, and NetworkPolicies to stop flat east-west traffic. If everything in your cluster can talk to everything else, you don't have segmentation — you have a single blast radius.

3. Stop hardcoding secrets

Secrets in env files and Git history are still one of the most common findings. Manage them properly:

HashiCorp Vault for dynamic secrets and central policy
Kubernetes Secrets with encryption at rest enabled (it isn't on by default in every setup - check)

4. Use the cloud's native detection (it's already there)

Each major cloud ships strong detection tooling that teams routinely leave half-configured:

AWS - GuardDuty, Security Hub, Macie, CloudTrail, Config
Azure - Defender for Cloud, Sentinel, Azure Monitor
GCP - Security Command Center

Knowing how to turn these on, tune the noise, and route findings somewhere a human will see them is a genuinely marketable skill.

5. The non-tool skill that ties it together: IAM

Every item above sits on top of identity. If your IAM policies are sloppy - wildcards everywhere, long-lived keys, no least-privilege - no scanner saves you. Designing tight IAM policies and understanding the shared-responsibility model is the core competency hiring managers probe hardest, because it's the one you can't fake with a dashboard.

Where this leads (the part that pays)

Put this toolchain together with real hands-on practice and you're qualified for roles that are, frankly, underfilled. Typical 2026 ranges in the Pakistani market:

Role	PKR/month	Remote (USD)
Cloud Security Engineer	150,000-320,000	$1,500-$3,000
DevSecOps Engineer	180,000-380,000	$2,000-$3,800
Cloud Security Architect	350,000-700,000	$3,500-$6,000

The fastest way in, if you already have 1-2 years of cloud/DevOps experience, is about 4–8 months of focused work on exactly the tools above - and it tends to lift your salary 25-40%. Build a GitHub portfolio with real security scenarios; that beats any certificate on its own.

I wrote a full, Pakistan-specific career breakdown - all seven cloud-security role types, the certification order and costs, and the three entry paths - over here: Cloud Security Careers in Pakistan.

Which of these tools is already in your pipeline, and which one are you avoiding? Drop it in the comments. 👇

How I'd Pass the CKA in 12 Weeks (Performance-Based, No Multiple Choice)

Sherdil IT Academy — Tue, 09 Jun 2026 12:16:17 +0000

The Certified Kubernetes Administrator (CKA) is not a multiple-choice exam, and that single fact changes everything about how you should prepare for it. There's no bluffing, no "process of elimination," no memorizing a question bank. You get 2 hours, 15–20 tasks, and a live Kubernetes cluster, and you need 66% to pass.

If you're a DevOps or platform engineer sitting this exam, here's the 12-week, lab-first plan I'd follow — plus the exam-day setup that quietly saves you the most time.

What you're actually walking into

The domains are weighted, and the weighting tells you exactly where to spend your hours:

Domain	Weight
Troubleshooting	30%
Cluster Architecture & Installation	25%
Services & Networking	20%
Workloads & Scheduling	15%
Storage	10%

Troubleshooting is the highest-weighted domain at 30% — and it's the one most candidates underestimate. You can't grind it with flashcards; you have to break clusters and fix them until CrashLoopBackOff, NodeNotReady, and broken DNS stop scaring you.

The exam costs $395 (~PKR 110,600) and includes one free retake within 12 months. It tests your ability to work efficiently with the docs, not to memorize every YAML field — but the clock is real.

The 12-week, lab-first plan

Target ~180–200 hours total: 2–3 hours on weekdays, 5–6 on weekends. The ratio that matters most: 20% concept review, 80% hands-on labs.

Weeks	Focus	Lab goal
1–2	Core architecture: Pods, ReplicaSets, Deployments, Namespaces, kubectl	Deploy 10+ apps via CLI only
3–4	Workloads & scheduling: limits, taints/tolerations, affinity, DaemonSets, CronJobs	Schedule pods on specific nodes; set resource quotas
5–6	Services & networking: ClusterIP, NodePort, LoadBalancer, Ingress, NetworkPolicies, CoreDNS	Configure Ingress with TLS; write a NetworkPolicy
7–8	Storage: PVs, PVCs, StorageClasses, access modes	Provision storage for a stateful app; resize a PVC
9–10	Cluster architecture: kubeadm init/join, RBAC, etcd backup/restore, certs	Build a multi-node cluster; back up and restore etcd
11	Troubleshooting: NotReady nodes, CrashLoopBackOff, DNS, apiserver failures	2 Killer.sh exams, target 70%+ each
12	Full timed simulation across all domains	2 Killer.sh + 1 KodeKloud mock

The resources that are actually worth it

Non-negotiable:

KodeKloud CKA course + labs — the best structured prep available. Pro is ~$16/mo; two months is enough.
Killer.sh simulator — two free full-length sessions come with your exam registration. It's harder than the real thing on purpose. Widely regarded as the most accurate simulation.
Official Kubernetes docs (kubernetes.io/docs) — allowed during the exam, but you won't have time to read pages end-to-end. Practice navigating them fast.

Skip: brain-dump sites, video-only prep with no labs, and theory without timed practice.

Exam-day setup (do this in the first 2 minutes)

Before touching a single task, configure your environment. These shortcuts pay for themselves many times over:

# Alias kubectl -> k
alias k=kubectl

# Dry-run template generator
export do='--dry-run=client -o yaml'

# Now you can scaffold YAML instead of typing it by hand:
k create deployment web --image=nginx $do > web.yaml

And set up vim for clean YAML editing:

" ~/.vimrc
set expandtab
set tabstop=2
set shiftwidth=2

The single most expensive mistake people make: forgetting to switch cluster context. Every question specifies its cluster. Do this first, every time:

kubectl config use-context <cluster-name>

Then work the exam strategically:

Read all tasks first (~3–4 minutes) and prioritise by weight.
Generate YAML with --dry-run=client -o yaml instead of writing it from scratch.
Flag and skip anything you get stuck on — come back later.
Verify before moving on: kubectl get, kubectl describe, kubectl logs.

One Pakistan-specific note: book a Pearson VUE test centre if you can. Remote proctoring needs a stable 5 Mbps+ line, a webcam, and a clean private room — test your home connection at your exam time a few days ahead, and have a different-carrier mobile hotspot as backup.

Is it worth the PKR 110,600?

For the Pakistani market in 2026, yes — the salary data is hard to argue with:

Role	Without CKA	With CKA	Uplift
DevOps (mid)	PKR 120–180K	PKR 180–280K	30–40%
Platform/K8s (mid)	PKR 200–320K	PKR 320–550K	40–50%
Platform/K8s (senior)	PKR 350–500K	PKR 500–800K	25–30%

And the remote ceiling is higher still: a CKA-certified engineer with 3–4 years of hands-on Kubernetes can realistically target $2,000–$3,500/month remote — roughly PKR 700,000/month at $2,500. Plenty of engineers have some Kubernetes experience; far fewer have the breadth the CKA forces you to build.

The honest prerequisite check

Don't book it yet if you have no Linux command-line comfort or zero hands-on infrastructure exposure — the CKA assumes both. If you're a pure app developer with no infra interest, look at the CKAD instead. But if you've got 1–2 years of Docker/CI-CD/Linux under your belt, 12 disciplined weeks is enough.

I wrote a full, Pakistan-specific breakdown of this — payment methods that work with local cards, a deeper resource tier list, and the complete week-by-week labs — over here: the complete CKA certification guide for Pakistani engineers".

What tripped you up most in your CKA prep — troubleshooting speed, or just finishing in time? Drop it in the comments. 👇