Private corporate batches, live online cohorts and 1-on-1 mentoring in asset inventory, vulnerability management, policy compliance and web application scanning on one platform — taught by a practitioner who runs it in production.
20 years across DevOps, SRE and Security · 10,000+ engineers trained · Trained teams at JPMorgan Chase, Verizon, Nokia and the World Bank
Principal DevOps Engineer & Architect
Rajesh teaches Qualys around the asset model first, because tagging is what determines whether reports, remediation rules and access control work at all — and it is the decision most deployments get wrong early and pay for later. Sessions cover sensor selection across scanner appliances, Cloud Agents, container and cloud connectors, authentication records for credentialed scanning, option profile tuning against scan windows, VMDR prioritisation and remediation rules, policy compliance against configuration benchmarks, web application scanning with authenticated crawls, and API-driven automation — all worked through against real subscription data rather than screenshots.
Twenty years across DevOps, SRE and Security, in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe and others. He has trained engineers at JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus — more than 10,000 people personally. He teaches what he runs, not what he reads.
You are booked with a named engineer, and that is who turns up. Marketplaces and larger providers rotate whoever is free, so the person who sold you the agenda is rarely the person teaching it.
The same trainer is available for the next engagement, which matters when a team builds on what it learned last time.
Your batch is assigned a named trainer before it starts, and that is who teaches it. See the full faculty.
Engagements are matched on the tool, not the calendar. For Qualys that means a trainer who has run it in production — asset inventory, vulnerability management, policy compliance and web application scanning on one platform — rather than whoever is free that week. You are told who is teaching before you commit, and that person is on the discovery call that shapes the agenda.
Where a batch is large enough to need a second trainer, the pairing is declared up front. The lead trainer stays accountable for the syllabus and the assessment either way.
Principal DevOps Engineer & Architect
Twenty years across DevOps, SRE and Security in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe, IBM/Emptoris, Ness, MindTree and Accenture. He has trained more than 10,000 engineers personally, at organisations including JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus. He teaches what he runs, not what he reads.
Teams of 8–30
Custom agenda, your timezone, onsite or online, NDA-friendly.
Request a quoteIndividual engineers
A private instructor and a curriculum built around your goal.
₹99,999Individuals who want peers
Scheduled batch, max 8 to 10 hours of live instruction.
₹34,999A private batch starts with a discovery call. We look at the stack you actually run — the CI system, the cloud, the constraints — and map the agenda onto it, so examples use your topology rather than a generic one.
Delivery is onsite at your premises, live online, or hybrid, scheduled around your release calendar rather than ours. Batches run 8 to 30 engineers.
Every attendee leaves with recordings, slides, lab repositories and a completion certificate. You receive an attendance and assessment report. Invoicing supports PO and GST.
Talk to us about a private Qualys batchQualys is a cloud-delivered security and compliance platform. Rather than a single scanner, it is a set of applications sharing one asset inventory and one data model: asset management, vulnerability management and remediation, policy compliance against configuration benchmarks, web application scanning, container and cloud posture assessment, and patch deployment. Because they share the platform, an asset discovered once carries its tags, its owner and its findings across every application that touches it — which is the main reason organisations consolidate onto it.
Data reaches the platform through several sensor types, and choosing among them is the first real design decision. Scanner appliances, virtual or physical, sweep networks the way a traditional scanner does and are the only option for devices you cannot install software on. The Cloud Agent installs on a host, collects continuously and reports without needing a scan window or inbound network access, which suits laptops, cloud instances and anything behind NAT. Passive sensors identify assets from network traffic, and container and cloud connectors pull inventory and configuration directly from registries and cloud provider APIs.
What makes the platform work or fail in practice is the asset model. Every asset carries tags, and tags — especially dynamic tags built from queries — drive scan targeting, report scope, dashboard filters, remediation rules and access control. A Qualys deployment with a coherent tagging scheme produces reports that route to the right team automatically. One without it produces accurate data that nobody can slice into a work queue, which is the single most common way an otherwise healthy deployment fails to deliver value.
Security operations consolidated. Running one tool for network scanning, another for configuration compliance, another for web application testing and a spreadsheet to reconcile them stopped being viable once estates spanned data centres, several cloud providers, container platforms and a remote workforce. Platforms that unify inventory and findings across all of that became the default enterprise answer, and Qualys is one of the small number that show up repeatedly in that role.
The pressure is regulatory as much as technical. Frameworks and customer questionnaires ask for continuous asset inventory, evidence of periodic vulnerability assessment, configuration compliance against a named benchmark and demonstrable remediation timelines. Producing that from separate tools is an exercise in reconciliation; producing it from one platform with a shared asset model is a reporting exercise, provided the deployment was designed for it.
The skill organisations look for is platform engineering rather than button-clicking. Choosing sensors per asset class, building an asset tagging scheme that survives reorganisation, writing authentication records so scans are credentialed, tuning option profiles so scans complete, defining remediation rules and ownership, extending compliance policies, and driving the platform through its API so scanning becomes part of automated workflows. That is what separates a licensed platform from a working programme.
How the platform is put together before touching any individual application. Subscriptions, modules and user roles; the shared asset inventory that everything else depends on; then the sensor types, what each can and cannot see, and how to decide which asset gets which.
Topics: Platform architecture and the shared asset data model · Subscriptions, activated modules and licensing units · Scanner appliances: physical, virtual and cloud-hosted · Cloud Agent: continuous collection without scan windows · Passive sensors and network-derived asset discovery · Container sensors and cloud connectors · Users, roles, business units and scoped access · Choosing a sensor strategy per asset class
The module that determines whether everything else works. Building and maintaining inventory across scanned, agent-reported and cloud-discovered assets, then the tagging model — static and dynamic tags, tag hierarchies, and the query language that turns 'internet-facing production database servers' into something you can target.
Topics: Asset discovery across sensors and deduplication · Host assets, cloud assets and unmanaged assets · Static tags versus dynamic tags built from queries · Tag hierarchies and inheritance · Asset search queries and building tags from them · Asset groups and business units, and when each still matters · Using tags to scope scans, reports, dashboards and permissions · Keeping tagging current as the estate changes
The core workflow. Option profiles and what each setting costs in scan time, authentication records for credentialed scanning, launching and scheduling scans, then reading detections — the vulnerability knowledge base, detection status, confirmed versus potential findings, and prioritisation that reflects real exposure.
Topics: Option profiles: port lists, detection settings and performance · Authentication records for Linux, Windows, databases and cloud instances · Verifying that a scan authenticated rather than assuming it did · Launching, scheduling and scoping scans by tag · The vulnerability knowledge base and detection identifiers · Confirmed, potential and information-gathered detections · Detection status: new, active, fixed and reopened · Prioritisation using asset context and threat indicators · Remediation rules, ticketing and SLA tracking
Continuous assessment without scan windows. Agent deployment and activation keys, configuration profiles that control how much the agent collects and how often, the practical differences between agent and scanner data, and operating a large agent fleet including the assets that stop reporting.
Topics: Agent installation across Linux, Windows and macOS · Activation keys, modules and deployment at scale · Configuration profiles: intervals, performance and data collection · Agent versus scanner data, and reconciling the two · Continuous assessment and near-real-time detection · Agents behind NAT, on laptops and in ephemeral cloud instances · Handling stale, duplicated and non-reporting agents · Agent upgrades and rollout control
The compliance half of the platform, which is a different discipline from vulnerability scanning. Importing and adapting benchmark policies, understanding controls and their expected values, running compliance scans, and managing exceptions with evidence rather than by lowering the standard.
Topics: Policy compliance versus vulnerability management · Technologies, controls and expected values · Importing benchmark policies and adapting them to reality · Creating and editing controls, including custom checks · Compliance scanning requirements and why credentials are mandatory · Posture assessment and reading pass, fail and error states · Exceptions: justification, approval and expiry · Mandate and framework mapping for audit reporting · Tracking compliance drift over time
Dynamic testing of web applications and APIs inside the same platform. Defining web applications and scope, authentication records for crawls that need to log in, importing API definitions, choosing scan profiles, and handling the findings and false positives that dynamic scanning produces.
Topics: Defining a web application, its scope and exclusions · Crawl settings, depth limits and links to follow or avoid · Authentication records for form and token-based logins · Verifying the crawl stayed authenticated · Selecting scan profiles and balancing depth against time · Importing API definitions for endpoint coverage · Reading findings, evidence and reproduction detail · Marking false positives and managing them across scans · Coordinating scanning with WAF and rate limiting
Making the platform produce outcomes rather than data. Report templates and scorecards, dashboards built on saved queries, integrations with ticketing and cloud providers, container image scanning in a pipeline, and driving the whole platform through its API so the routine work stops being manual.
Topics: Report templates: technical, executive and scorecard reports · Query-driven dashboards and widgets per audience · Scheduled report distribution and access control · Cloud connectors for AWS, Azure and GCP inventory and posture · Container image scanning in a build pipeline · Ticketing integration with Jira and ServiceNow · The platform API: authentication, rate limits and pagination · Scripting scan launch, result export and asset tagging · Designing the operating cycle: discover, assess, prioritise, remediate, verify
We rebuild the agenda around the tools you actually run.
Request a custom agendaBuild a dynamic tag hierarchy from asset queries, then prove the same tags scope a scan, a report, a dashboard and a permission set without duplication.
Configure authentication records for Linux, Windows and a database, run a credentialed scan and evidence successful authentication rather than assuming it from the result count.
Deploy Cloud Agents through configuration management with activation keys and configuration profiles, then find and resolve the agents that stopped checking in.
Run a configuration benchmark policy against a server class, remediate failing controls, re-scan to prove the change and raise one exception with evidence and an expiry.
Define a web application with scope and exclusions, configure an authenticated crawl, import an API definition and prove protected endpoints were actually tested.
Script asset tagging, scan launch, result export and ticket creation through the API, schedule it and produce audience-specific reporting from the same data.
Billed yearly at ₹9,996
Max 8 to 10 hours of live instruction
Full program, private instructor
8–30 engineers · custom agenda · onsite or online · PO and GST invoicing
Refunds. If we cancel or postpone a cohort, you get a full refund within 15 days. There is no money-back guarantee otherwise.
Terms. Course material remains licensed to the attendee. Read the terms.
Your data. We don't share it with third parties. Privacy policy.
Certificate of completion
Rajesh is a very good trainer I have experienced in DevSecOps training. The number of contents in different topics he has posted on the DevOpsSchool public website are amazing and user friendly for beginners and experienced professionals.
The trainer (Rajesh) provided very good sessions on SRE profession. Not only hands-on learning on the tools but also SRE mindset.
Very good training session. Well explained from the basics to the complex concepts. Also tried to cover practicals and demos within the 3 hour sessions. The learning content and videos are of a great deal of help.
Basics explanation was exemplary from Rajesh where he dealt with complicated topics to be simple. Great learning stuff personally for me.
Very detailed explanation and has lots of patience in attending the questionnaire. Thanks again for your wonderful sessions.
Good discussion, helped us to understand different tools in SRE.
| What matters | YouTube + blogs | Generic online course | Freelance marketplace | DevOpsSchool |
|---|---|---|---|---|
| Named practitioner | No | Rarely | Varies per booking | Yes — same trainer each time |
| Production experience | Unknown | Unknown | Unverified | 20 years, named employers |
| Custom agenda | No | No | Sometimes | Built from your stack |
| Onsite delivery | No | No | Sometimes | Yes |
| Lab environment | None | Sandbox that expires | Varies | Your own cloud — skill goes with you |
| Assessment | None | Quiz | Rarely | Assignments + capstone per module |
| Per-attendee certificates | No | Sometimes | Rarely | Yes |
| Corporate invoicing | No | Limited | Varies | PO and GST |
| Post-training support | None | Forum, time-limited | None | Lifetime forum access |
Tell us the team, the stack and the timeline. You'll get a straight answer, not a sales sequence.
Talk to an advisorPrefer to call or email?
More ways to reach us on the contact page.