💰 The finding that paid for this page: it's TWO budgets, not one
AWS exam voucher — one per year, 100% discount, ANY AWS exam. Claimed as a unique code in AtoZ, entered at Pearson VUE checkout.
Career Choice — $5,250 for 2027, $0 used, $0 reserved, expires 12/31/2027. Allocated to SANS CyberLaunch (tuition $5,250, out-of-pocket $0).
AWS Skill Builder — free to employees. Study for all of it.
They do not compete. That is the whole trick.
🎯 WHICH EXAM GETS THE VOUCHER — the strategic answer
The voucher is capped by what you point it at: Foundational ~$100 · Associate ~$150 · Professional/Specialty ~$300. So the naive answer is "spend it on the most expensive exam."
That is wrong. A 100% voucher on an exam you fail is worth $0. The voucher's real value = probability of passing × exam price. A Professional exam wants years of hands-on AWS — you'd be betting your one free slot on the hardest target.
✅ Recommendation: SAA-C03 — Solutions Architect Associate ($150).
• It is the #1 named cloud cert in the measurement — 1,675 US postings.
• It is the cert the FDE skill list names (AWS 14, Kubernetes 12, Docker 12).
• It is the door, not the trophy. A $150 cert that gets you hired beats a $300 cert that does not.
⚠️ The ORDER matters more than the choice. Passing any AWS exam also mints the separate 50% certified-individual voucher. So play it:
this year's 100% voucher → CCP (free) → CCP mints the 50% → next year's 100% voucher → SAA-C03 (free).
Two certs, $0, and a 50% voucher still in hand.
⚠️ One unverified fact gates the calendar
Is the 100% voucher per calendar year or rolling 12 months?
If calendar: claim in Dec 2026 + claim in Jan 2027 → two free exams ~3 months apart, both before SANS starts Feb 15. That's CCP and SAA-C03, free.
If rolling: one exam per 12 months → SAA-C03 slips to 2028.
→ Milestone C0 is a 30-second AtoZ look. Everything downstream depends on it.
Out of pocket
$0
4 credentials
Funded streams
2
independent
Next hard date
Feb 8
2027 · SANS apply
Plan horizon
≤2 yrs
to remote role
Real constraint
Capacity
not money
🔴 The honest read — read this before the milestones
This is not a 6-month exit plan. The measured FDE gate was "2–6+ years, mostly 5+", and no credential shortcuts that.
What this plan does instead: it builds the years while employed. By Feb 2028: ~3 years at Amazon, four credentials, and a live operating portfolio. That is a genuinely different candidate from the one measured on 2026-10-26.
And the thing that will actually decide it is capacity — 16–20 hrs/week for 12 months, on top of full-time work and the fleet. Not eligibility. Not money.
⚡ Upside case: this could finish in 6–12 months, not 24
The two-year horizon is deliberate slack, not a prediction. Three reasons it may run much faster:
• The fleet is the study group. Four seats, a vault, and an engine that serves the next unmet step — that is a tutoring system most learners do not have.
• Half the SAA-C03 syllabus is already operated. Containers, deployments, networking, IAM-shaped least-privilege, CI — the fleet does all of it daily. Cloud study is naming what already exists, not learning from zero.
• CCP is genuinely small (~20–40h) and SAA is ~40–120h. At fleet-assisted pace that is one season, not a year.
⚠️ But the honest brake: the SANS half does not compress. It is a fixed 12-month program at 16–20 hrs/week with two in-person Pearson VUE exams. The AWS half can accelerate; the SANS half cannot.
So the realistic fast case: AWS certs done by early 2027, and the AWS-based job search starting then — while SANS runs underneath.
🧭 Why this over Web3 — the honest trade, written down
We looked for the Web3 lane first, at length, and it did not answer. That is a measured result, not a mood: in the posting corpora we sampled, agent frameworks appeared in ~1 of 30 postings and MCP in 0 of 30 — the things we are best at are the things the market names least.
Meanwhile cloud certs are named in the thousands (SAA-C03: 1,675 postings). The difference is not skill — it is whether the market has a NAME for the work yet.
⚠️ And this does not cancel Web3. It reclassifies it from the plan to the side. The x402 rail, the ERC-8004 identity work and the Treasury all keep running underneath — this track buys the income and the runway that let them keep running without needing to pay the rent.
📋 The milestones
C0 · Confirm the voucher rule
BLOCKS C1 + C2
Why: One unverified fact decides the entire calendar. 30 seconds of looking, and everything downstream rearranges around the answer.
- AtoZ → Benefits → Amazon For Amazonians → AWS Training and Certification
- Find the eligibility wording: calendar year or rolling 12 months?
- Is a 2026 voucher still claimable today?
- Search the AtoZ catalog for any cloud program before committing the Career Choice budget
Done when: the per-year rule is written down with a screenshot, and the cloud-catalog question is answered.
C1 · AWS Cloud Practitioner (CLF-C02)
READY · ~30 hrs
Why: the entry credential for every cloud lane, the cheapest possible use of the first voucher, and the study is free via Skill Builder. It also mints the separate 50% certified-individual voucher for later.
- Skill Builder → Cloud Practitioner Essentials
- Claim the 100% voucher in AtoZ, enter it at Pearson VUE checkout
- Book it — test centre or online proctored
- Pass it. Record the certificate number.
Done when: a PASS result exists. Not "studying started". · Window: claim Dec 2026, exam by mid-Jan 2027.
C2 · AWS Solutions Architect Associate (SAA-C03)
READY · ~80 hrs
Why: the #1 named cloud cert in the whole measurement — 1,675 US postings. The one that says "cloud engineer" to a screener. The voucher makes it free.
- Claim the NEXT year's voucher (Jan 2027, under the calendar-year reading)
- Skill Builder course + hands-on in a free AWS account
- Mock it for a real score before booking — not a feeling
- Pass it. Record the certificate number.
Done when: a PASS result exists. · Window: exam by mid-Feb 2027, before SANS. ⚠️ Tight.
C3 · SANS CyberLaunch — GFACT (SEC275)
STARTS FEB 15 2027
Why: fully funded by Career Choice. "No tech background required." GIAC certs map to DoD 8140 — the one lane where a cert is a legal key rather than a tiebreaker.
- Apply by Feb 8 2027 — hard deadline. All 2026 seats were full.
- SEC275 — core computing, technology, security fundamentals
- GFACT exam, in person at a Pearson VUE testing centre
- ~15–20 hrs/week
Done when: GFACT passed and recorded. · Margin: one free retake if within 10% of the pass score.
C4 · SANS CyberLaunch — GSEC (SEC401)
2027 → FEB 2028
Why: network security, threat detection, system defence. This is the credential that opens SOC / security-engineer roles — the most remote-viable outcome in the entire Career Choice catalog.
- SEC401 coursework, ~15–20 hrs/week
- GSEC exam, in person at Pearson VUE
- After passing: activate SANS Skills Quest — 6 months of SOC ops, threat hunting, DFIR, cloud security
Done when: GSEC passed, recorded, Skills Quest activated.
C5 · The remote role — the actual goal
≤ LATE 2028
Why this milestone exists: so the plan names its own finish line instead of drifting. Four credentials + ~3 years at Amazon + a live portfolio is a different candidate entirely.
- Keep the portfolio publishing throughout — one legible artifact, not a pile
- Internal door first: an Amazon cloud/IT transfer is the lowest-risk move and uses tenure already earned
- External door second: cloud engineer (SAA) or security (GIAC) — whichever the market answers first
- Do not wait for the plan to finish before applying. Apply when a credential lands.
Done when: an offer is accepted. Not "applications sent".
⏰ Hard dates
2026-12-31
2026 Career Choice budget expires — $0 used, and SANS draws on 2027. Nothing lost.
2027-02-08
SANS APPLICATION DEADLINE. Hard. 2026 seats filled; programming resumed Feb 2027.
2027-02-15
SANS starts. From here: 16–20 hrs/week for 12 months. AWS certs must precede this.
2028-02-14
SANS program ends. GSEC in hand, Skills Quest active.