Private corporate batches, live online cohorts and 1-on-1 mentoring in defensive security engineering — identity, network, host, application and cloud controls, with detection and response — taught by a practitioner who runs it in production.
20 years across DevOps, SRE and Security · 10,000+ engineers trained · Trained teams at JPMorgan Chase, Verizon, Nokia and the World Bank
Principal DevOps Engineer & Architect
Rajesh teaches cybersecurity as engineering rather than as a certification syllabus: identity and privilege design, network segmentation and TLS configuration, host and image hardening, key management, and the logging and detection layer that catches what the other controls miss. Every domain is taught against running systems — an actual directory, an actual firewall policy, an actual set of logs — with time spent on how controls fail in production, because a control nobody can operate is a control that does not exist.
Twenty years across DevOps, SRE and Security, in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe and others. He has trained engineers at JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus — more than 10,000 people personally. He teaches what he runs, not what he reads.
You are booked with a named engineer, and that is who turns up. Marketplaces and larger providers rotate whoever is free, so the person who sold you the agenda is rarely the person teaching it.
The same trainer is available for the next engagement, which matters when a team builds on what it learned last time.
Your batch is assigned a named trainer before it starts, and that is who teaches it. See the full faculty.
Engagements are matched on the tool, not the calendar. For Cybersecurity that means a trainer who has run it in production — defensive security engineering — identity, network, host, application and cloud controls, with detection and response — rather than whoever is free that week. You are told who is teaching before you commit, and that person is on the discovery call that shapes the agenda.
Where a batch is large enough to need a second trainer, the pairing is declared up front. The lead trainer stays accountable for the syllabus and the assessment either way.
Principal DevOps Engineer & Architect
Twenty years across DevOps, SRE and Security in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe, IBM/Emptoris, Ness, MindTree and Accenture. He has trained more than 10,000 engineers personally, at organisations including JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus. He teaches what he runs, not what he reads.
Teams of 8–30
Custom agenda, your timezone, onsite or online, NDA-friendly.
Request a quoteIndividual engineers
A private instructor and a curriculum built around your goal.
₹99,999Individuals who want peers
Scheduled batch, max 8 to 10 hours of live instruction.
₹34,999A private batch starts with a discovery call. We look at the stack you actually run — the CI system, the cloud, the constraints — and map the agenda onto it, so examples use your topology rather than a generic one.
Delivery is onsite at your premises, live online, or hybrid, scheduled around your release calendar rather than ours. Batches run 8 to 30 engineers.
Every attendee leaves with recordings, slides, lab repositories and a completion certificate. You receive an attendance and assessment report. Invoicing supports PO and GST.
Talk to us about a private Cybersecurity batchCybersecurity is the engineering discipline of protecting your own systems, networks, applications and data from unauthorised access, disruption and loss. It is defensive work: establishing what an attacker would have to do to reach something valuable, then arranging identity, network, host, application and monitoring controls so that each step is blocked, made expensive, or observed loudly enough that someone can respond before it matters.
The practice is organised around a small number of control domains that recur regardless of stack. Identity and access management decides who and what may authenticate, and what they can do afterwards. Network security constrains reachability through segmentation, filtering and encrypted transport. Host and endpoint security limits what a compromised process can reach, through hardening, patching and least privilege. Application security covers the code and the dependencies it pulls in. Cryptography and key management sit underneath all of them. Detection and response exist because some control will eventually fail, and the failure has to be visible.
What separates cybersecurity as engineering from cybersecurity as paperwork is that every one of those controls has a configuration, a failure mode and a running cost. A firewall rule nobody can explain, an MFA policy with a permanent bypass group, a TLS endpoint still negotiating a deprecated cipher, a privileged service account with a password set in 2019, or a log source that quietly stopped shipping three weeks ago are all completely normal findings — and all of them are found by engineers who know where to look, not by a policy document. That is the level this training works at.
Security stopped being a separate department's problem the moment infrastructure became code. The people who create identities, open ports, choose base images, write Terraform and configure logging are platform, DevOps and application engineers, which means most security outcomes are now decided by engineering choices made long before anyone from a security team sees them.
At the same time the consequences moved. Ransomware and supply-chain compromise turned security incidents from embarrassing into existential, and regulators and enterprise customers now ask for evidence rather than assurances — access reviews, patch timelines, encryption standards, log retention, incident response records. Answering those questions requires controls that genuinely exist and can be demonstrated, not a policy library.
The scarce skill is not awareness. Every engineer knows least privilege is good. The skill organisations hire for is the ability to implement it against a running estate without breaking delivery: to scope an IAM policy correctly, segment a network that was flat for a decade, harden a host image without breaking the application on it, and build detection that fires on real attacker behaviour rather than on noise.
The framing every later module depends on. What you own, what an attacker wants, and how controls are chosen by risk reduction rather than by product category. Confidentiality, integrity and availability as engineering trade-offs, and the difference between a vulnerability, a threat and a risk.
Topics: Confidentiality, integrity and availability as design constraints · Assets, trust boundaries and attack surface · Threat, vulnerability, likelihood and impact · Common attack patterns and how they chain · Defence in depth and the assume-breach posture · Control types: preventive, detective, corrective · Risk registers that engineers actually use
The control domain that decides the blast radius of everything else. Authentication mechanisms and their failure modes, authorisation models, privileged access, and the lifecycle work — provisioning, review and revocation — that determines whether least privilege survives past its first quarter.
Topics: Authentication factors, MFA and phishing-resistant methods · Directory services, federation, SAML and OIDC · RBAC and ABAC compared, and when each breaks down · Service accounts, machine identity and credential rotation · Privileged access: tiering, just-in-time and break-glass · Joiner-mover-leaver and access recertification · Common IAM misconfigurations and how to find them
Constraining what can reach what. Segmentation strategy, where filtering belongs, and how east-west traffic differs from north-south. Then transport security in practice — TLS configuration, certificate lifecycle and the misconfigurations that survive because nothing visibly breaks.
Topics: Segmentation, zoning and micro-segmentation · Stateful firewalls, security groups and network policy · North-south versus east-west controls · TLS versions, cipher suites and protocol hardening · Certificate issuance, validation, pinning and expiry · VPN and zero-trust network access compared · DNS security, egress control and data exfiltration paths
Reducing what a compromised process can do. Linux and Windows baseline hardening, patch and configuration management, and the container-specific controls that matter once workloads stop being long-lived servers. Hardening is only real if it is verified continuously, so verification is built in from the start.
Topics: CIS Benchmarks and building an achievable baseline · Least privilege on Linux: users, capabilities, sudo policy, SELinux and AppArmor · Windows hardening: local policy, LAPS, service accounts · Patch management, exposure windows and emergency patching · Container hardening: non-root, read-only root filesystem, dropped capabilities, seccomp · Golden images and immutable infrastructure · Automated compliance verification and drift detection
Applied cryptography for engineers who have to make choices rather than design primitives. What to use where, how keys are generated, stored, rotated and destroyed, and the specific mistakes — reused nonces, hard-coded keys, home-grown encryption, unbounded key lifetime — that turn correct algorithms into broken systems.
Topics: Symmetric and asymmetric cryptography and where each belongs · Hashing, salting and password storage · Authenticated encryption and mode selection · PKI, certificate authorities and chains of trust · Key generation, storage, rotation and destruction · Secrets management systems and what they replace · Encryption at rest and in transit: what each actually protects against
Where most breaches start. Common vulnerability classes and their defensive patterns, secure configuration of web-facing services, and the dependency supply chain — because most of the code running in production was written by someone else and pulled in by a package manager.
Topics: OWASP Top 10 classes and the defences for each · Input validation, output encoding and parameterised queries · Session management, authentication flows and token handling · Security headers, CORS and cookie configuration · Dependency and container vulnerability scanning · SBOM generation and provenance · Secure code review and where automation stops
Assume-breach made operational. Which events are worth collecting, how to get them off the host reliably, and how to turn them into detections that fire on attacker behaviour rather than on volume. Includes the unglamorous parts: retention, time synchronisation, log integrity and knowing when a source has gone silent.
Topics: Choosing log sources: auth, process, network, cloud control plane, application · Collection pipelines, normalisation and time synchronisation · Log integrity, retention and tamper resistance · Writing detections and reducing false positives · Mapping detections to MITRE ATT&CK technique coverage · Alert routing, severity and on-call load · Detecting a dead log source before an audit does
What happens when a control fails. The response lifecycle from detection to lessons learned, the decisions that have to be made under time pressure, and the backup and recovery capability that determines whether a ransomware event is a bad week or a company-ending one. Then the governance layer that turns all of it into evidence.
Topics: Incident response lifecycle: prepare, detect, contain, eradicate, recover, learn · Severity classification and escalation paths · Containment decisions and their business trade-offs · Evidence handling and forensic readiness · Backup, immutability and tested restore procedures · NIST CSF, CIS Controls and ISO 27001 mapped to technical controls · Generating audit evidence from systems rather than by hand
We rebuild the agenda around the tools you actually run.
Request a custom agendaAudit a real directory or cloud account for stale, over-privileged and unused identities, then remediate the worst without breaking the workloads that depend on them.
Take a flat environment, define zones and allowed flows, implement filtering and egress control, then verify the design by attempting the flows that should now fail.
Harden a Linux host and a container image to a CIS baseline, then write automated checks that fail the build when the baseline drifts.
Move a service from hard-coded credentials to managed secrets, implement rotation, then simulate a key compromise and execute the recovery procedure.
Instrument a host and a cloud account, generate both benign and suspicious activity, and tune three detections until they fire on the second and not the first.
Run a credential-compromise incident from alert through containment and eradication, then perform a timed restore from backup and write the post-incident record.
Billed yearly at ₹9,996
Max 8 to 10 hours of live instruction
Full program, private instructor
8–30 engineers · custom agenda · onsite or online · PO and GST invoicing
Refunds. If we cancel or postpone a cohort, you get a full refund within 15 days. There is no money-back guarantee otherwise.
Terms. Course material remains licensed to the attendee. Read the terms.
Your data. We don't share it with third parties. Privacy policy.
Certificate of completion
Rajesh is a very good trainer I have experienced in DevSecOps training. The number of contents in different topics he has posted on the DevOpsSchool public website are amazing and user friendly for beginners and experienced professionals.
Very good training session. Well explained from the basics to the complex concepts. Also tried to cover practicals and demos within the 3 hour sessions. The learning content and videos are of a great deal of help.
Basics explanation was exemplary from Rajesh where he dealt with complicated topics to be simple. Great learning stuff personally for me.
Very detailed explanation and has lots of patience in attending the questionnaire. Thanks again for your wonderful sessions.
Good discussion, helped us to understand different tools in SRE.
Got good lab sessions which kept the new DevOps tool learnings to the point and it helped a lot in my career.
| What matters | YouTube + blogs | Generic online course | Freelance marketplace | DevOpsSchool |
|---|---|---|---|---|
| Named practitioner | No | Rarely | Varies per booking | Yes — same trainer each time |
| Production experience | Unknown | Unknown | Unverified | 20 years, named employers |
| Custom agenda | No | No | Sometimes | Built from your stack |
| Onsite delivery | No | No | Sometimes | Yes |
| Lab environment | None | Sandbox that expires | Varies | Your own cloud — skill goes with you |
| Assessment | None | Quiz | Rarely | Assignments + capstone per module |
| Per-attendee certificates | No | Sometimes | Rarely | Yes |
| Corporate invoicing | No | Limited | Varies | PO and GST |
| Post-training support | None | Forum, time-limited | None | Lifetime forum access |
Tell us the team, the stack and the timeline. You'll get a straight answer, not a sales sequence.
Talk to an advisorPrefer to call or email?
More ways to reach us on the contact page.