If you are learning DevSecOps, I would not recommend trying to find one book that covers everything. DevSecOps sits at the intersection of DevOps, application security, cloud, automation, software development, and operations.
A better approach is to read a few books in a logical order and practice the concepts while building your own CI/CD pipeline.
The DevOps Handbook
The DevOps Handbook by Gene Kim, Jez Humble, Patrick Debois, John Willis, and Nicole Forsgren is a good starting point if you are new to DevOps.
It helps explain continuous delivery, automation, feedback loops, collaboration, and improving software delivery processes. The second edition also covers agility, reliability, and security.
This is useful because DevSecOps builds security into the DevOps workflow rather than treating security as a separate final-stage activity.
DevSecOps by Jim Bird
DevSecOps: A Leader’s Guide to Producing Secure Software Without Compromise by Jim Bird is a more direct introduction to DevSecOps.
It is useful for understanding how security activities can be incorporated into development and delivery processes instead of becoming a manual security gate at the end of the pipeline.
Securing DevOps
Securing DevOps by Julien Vehent is a strong choice for people who want a practical engineering perspective.
It is particularly useful for understanding how security can be integrated into infrastructure, automation, deployment pipelines, and operational processes.
Agile Application Security
Agile Application Security is worth reading if your goal is to understand application security within an agile and DevOps environment.
It helps connect development practices with security activities such as secure design, threat modeling, security testing, and vulnerability management.
Building Secure and Reliable Systems
Building Secure and Reliable Systems from Google is another excellent resource, especially for engineers moving toward senior DevSecOps, SRE, or security engineering roles.
It connects security and reliability instead of treating them as completely separate concerns. This is particularly useful when designing production systems where availability, resilience, security, and operational risk must be considered together.
Hands-On Security in DevOps
If you prefer practical learning, Hands-On Security in DevOps is a useful choice.
Rather than focusing only on security theory, look for resources that help you understand how security controls actually fit into a pipeline—for example:
- SAST
- DAST
- Software Composition Analysis
- Container scanning
- Secrets detection
- Infrastructure-as-Code scanning
- Dependency management
- Security testing
- Vulnerability remediation
Threat Modeling: Designing for Security
Threat modeling is an important DevSecOps skill because security should ideally be considered before code reaches production.
A resource such as Threat Modeling: Designing for Security can help you understand how to identify assets, threats, attack paths, trust boundaries, and mitigations during system design.
Don't Depend Only on Books
For DevSecOps, books should be combined with current standards and practical documentation.
For example, NIST's Secure Software Development Framework (SSDF) provides structured practices for integrating secure development activities into the software lifecycle. NIST's DevSecOps work also focuses on applying SSDF practices in cloud-based DevSecOps environments.
OWASP resources are also valuable for application security, while NIST provides useful material around secure software development and software supply-chain security.
A Practical Reading Order
I would suggest this sequence for someone starting from scratch:
1. The DevOps Handbook
Build your DevOps foundation.
2. DevSecOps by Jim Bird
Understand the DevSecOps mindset and workflow.
3. Securing DevOps
Learn how security can be integrated into engineering and deployment.
4. Agile Application Security
Strengthen your application-security knowledge.
5. Threat Modeling: Designing for Security
Learn to identify security risks before implementation.
6. Building Secure and Reliable Systems
Develop a stronger production security and reliability mindset.
After that, move into specialized areas such as Kubernetes security, container security, cloud security, software supply-chain security, and security automation.
Most Important Point
I would not measure DevSecOps knowledge by the number of books you have completed.
Take one concept from each chapter and implement it.
For example, create a small application and build a pipeline that performs:
Git → Build → Unit Tests → SAST → Dependency Scan → Container Build → Container Scan → DAST → Deployment → Monitoring
Then add secrets management, IaC scanning, image signing, vulnerability remediation, and policy enforcement.
That kind of hands-on project will teach you considerably more than reading DevSecOps theory alone.
For a DevSecOps learner, the best combination is books for concepts + official security standards for current practices + hands-on labs for implementation.