In my opinion, the best approach for a DevOps engineer to move into DevSecOps is to build on their existing automation and CI/CD knowledge while gradually embedding security into each stage of the pipeline, rather than treating it as a separate layer. The first skills to prioritize are understanding common security fundamentals like the OWASP Top 10, secure coding practices, and basic threat modeling, because they help identify risks early in development. After that, learning how to integrate automated security checks such as static code analysis (SAST), dependency and vulnerability scanning, and secrets management into CI/CD pipelines becomes essential. Gaining hands-on experience with container security, infrastructure-as-code scanning, and access control policies also adds practical value. It’s equally important to focus on continuous monitoring and compliance practices to maintain security in production. Overall, the transition is about shifting mindset from just automation and delivery speed to building secure, reliable systems by design, with security integrated throughout the entire lifecycle.