DevSecOps Engineering

Learn the vocabulary every DevSecOps conversation uses: confidentiality, integrity and availability, least privilege, defence in depth and zero trust. Understand how vulnerabilities are catalogued and scored (CVE, CWE, CVSS v4) so you can reason about risk instead of reacting to scanner noise.

Most attacks land on a Linux host or travel over the network, so you need to read permissions, processes and traffic fluently. Learn enough applied cryptography (TLS 1.3, PKI, hashing, key management) to configure it correctly and spot when it is misused.

• Linux
• Bash

The OWASP Top 10:2025 is the shared language between developers and security teams; it moves Security Misconfiguration to second place, adds Software Supply Chain Failures and Mishandling of Exceptional Conditions, and folds SSRF into Broken Access Control. Learn each risk by exploiting and then fixing it in a deliberately vulnerable app, and use the OWASP Cheat Sheets as your secure-coding reference.

DevSecOps is mostly an operating model: shared ownership of security, paved roads instead of gates, and fast feedback inside developer workflows. Learn the frameworks you will map your work to, especially the NIST Secure Software Development Framework and OWASP ASVS 5.0 for verifiable application security requirements.

Threat modeling finds design flaws before any code exists, which is far cheaper than finding them in production. Practise the four-question framework with STRIDE on data-flow diagrams, keep models as code next to the service, and revisit them whenever the architecture changes.

• OWASP Threat Dragon

Leaked credentials remain one of the fastest paths to a breach, and CI systems and AI agents now handle more secrets than ever. Block secrets before they are pushed, scan full history, rotate anything exposed and protect branches so every change is reviewed.

• Git
• GitHub
• Gitleaks
• TruffleHog

SAST catches injection, unsafe deserialisation and similar flaws while the developer is still in the pull request. Learn how taint analysis works, write custom rules for your own frameworks, tune out false positives and decide which findings should block a merge.

• Semgrep
• CodeQL
• SonarQube

Most of your application is open-source code, so dependencies carry most of your known vulnerabilities and a growing share of outright malware. Learn to find vulnerable and malicious packages, prioritise by exploitability rather than raw CVSS, and keep dependencies current with automated update pull requests.

• Snyk
• OSV-Scanner
• Renovate

Pipelines hold the keys to production, and the 2025–2026 attacks on GitHub Actions and package registries showed how one poisoned workflow can leak secrets across thousands of repositories. Lock down workflow permissions, replace stored cloud keys with OIDC federation, pin third-party actions to commit SHAs and audit workflows automatically.

• GitHub Actions
• GitLab CI/CD
• zizmor

A software bill of materials is now a contractual and regulatory expectation, not a nice-to-have. Generate SBOMs at build time in SPDX or CycloneDX, store and query them centrally, and publish VEX statements so customers know which CVEs actually affect them.

• Syft
• Trivy
• OWASP Dependency-Track

Signing and provenance let consumers verify who built an artifact, from which source and how. Learn the SLSA v1.2 Build and Source tracks, produce in-toto provenance attestations in CI, sign keylessly with Sigstore and enforce verification before anything is deployed.

• Sigstore
• GitHub Actions

Treat registries as security boundaries: promote immutable, scanned and signed artifacts instead of rebuilding per environment. Use OpenSSF Scorecard to judge the health of the open-source projects you depend on and to harden your own repositories.

• Harbor
• OpenSSF Scorecard

Dynamic testing finds what static tools cannot: misconfigurations, broken authentication and the runtime behaviour of the deployed app. Run ZAP baseline and API scans against ephemeral preview environments and make sure your tests cover the OWASP API Security Top 10.

• ZAP
• Nuclei

Small, non-root, regularly rebuilt images remove most container vulnerabilities before a scanner ever runs. Learn multi-stage builds, minimal and distroless base images, rootless runtimes and how to scan images for CVEs, embedded secrets and misconfigurations.

• Docker
• Podman
• Trivy

Kubernetes is secure only when it is configured to be, because defaults favour compatibility. Work through the 4C model: lock down RBAC and service accounts, enforce Pod Security Standards, segment traffic with NetworkPolicies, encrypt Secrets at rest and benchmark clusters against CIS.

• Kubernetes
• kube-bench
• Kubescape

Policy as code turns security standards into automated, testable guardrails that run in CI and at the cluster's front door. Learn Kyverno and OPA Gatekeeper with Rego, plus native CEL-based ValidatingAdmissionPolicy, and use them to require signed images, resource limits and approved registries.

• Kyverno
• OPA

Cloud breaches usually start with a misconfiguration, and nearly all cloud configuration now lives in Terraform or OpenTofu. Scan IaC in pull requests, evaluate plans against policy before apply, keep secrets out of state and detect drift from the reviewed baseline.

• Terraform
• OpenTofu
• Checkov

The goal is no long-lived secrets at all: workloads prove who they are and receive short-lived credentials. Learn dynamic secrets and leasing in Vault or OpenBao, sync secrets into Kubernetes safely, and use SPIFFE/SPIRE or cloud workload identity for service-to-service trust.

• Vault
• OpenBao
• External Secrets Operator
• SPIFFE/SPIRE

In the cloud, identity is the perimeter and misconfiguration is the main risk. Design least-privilege IAM with organisation-level guardrails, centralise audit logs and continuously assess posture against CIS benchmarks with CSPM tooling across AWS, Azure and Google Cloud.

• AWS
• Microsoft Azure
• Google Cloud
• Prowler

Prevention eventually fails, so you need to see what workloads actually do at runtime. Use eBPF-based sensors to detect shells in containers, unexpected network connections and privilege escalation, map detections to MITRE ATT&CK and, where it is safe, enforce in the kernel.

• Falco
• Tetragon

Detection only helps if someone can act on it quickly and learn from it. Centralise security telemetry, write detections as code, rehearse playbooks for cloud and Kubernetes compromises, and know your external reporting duties such as the EU Cyber Resilience Act 24-hour early warning.

• Elastic Stack
• Splunk

Scanners produce thousands of findings; a vulnerability program decides which matter and proves they were fixed. Prioritise with exploitability data, set remediation SLAs, and generate audit evidence for SOC 2, ISO 27001 or PCI DSS automatically from pipelines and policies.

LLM apps and AI agents introduce new attack paths: prompt injection, excessive agency, leaked system prompts and poisoned retrieval data. Learn the OWASP Top 10 for LLM Applications (2025) and the OWASP Top 10 for Agentic Applications (2026), and secure MCP tool integrations with least privilege and correct OAuth handling.

Treat models and prompts like any other untrusted dependency and test them adversarially before release. Automate LLM vulnerability scans and red-team suites in CI, verify model provenance and safe serialisation formats, and use MITRE ATLAS and the NIST AI RMF to structure AI risk.

• garak
• PyRIT
• promptfoo
• Hugging Face

AI coding assistants and agents now write and even merge a large share of code, which shifts security work toward review, guardrails and permissions. Set policy for AI tools, catch hallucinated or malicious package suggestions, keep secrets out of prompts and sandbox agents that run in CI.

Tools only matter if teams adopt them, so the senior DevSecOps job is designing the operating model. Run an OWASP SAMM assessment, build paved roads with secure defaults, grow a security champions network and report outcome metrics that leadership understands.