Private corporate batches, live online cohorts and 1-on-1 mentoring in full-lifecycle container and host protection — scanning, compliance, runtime defence, CNNF and WAAS — taught by a practitioner who runs it in production.
20 years across DevOps, SRE and Security · 10,000+ engineers trained · Trained teams at JPMorgan Chase, Verizon, Nokia and the World Bank
Principal DevOps Engineer & Architect
Rajesh teaches Twistlock as a platform to be operated rather than a dashboard to be toured: Console and Defender architecture and its failure modes, vulnerability and compliance policy design with explicit blocking decisions, behavioural runtime models moved safely from learning to prevention, and the network and web enforcement layers configured without dropping legitimate traffic. Sessions run against a live deployment with real images and real workloads, and cover collections, RBAC, alert routing and upgrade paths — because a platform that only one engineer can change is a platform that stops being updated.
Twenty years across DevOps, SRE and Security, in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe and others. He has trained engineers at JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus — more than 10,000 people personally. He teaches what he runs, not what he reads.
You are booked with a named engineer, and that is who turns up. Marketplaces and larger providers rotate whoever is free, so the person who sold you the agenda is rarely the person teaching it.
The same trainer is available for the next engagement, which matters when a team builds on what it learned last time.
Your batch is assigned a named trainer before it starts, and that is who teaches it. See the full faculty.
Engagements are matched on the tool, not the calendar. For Twistlock that means a trainer who has run it in production — full-lifecycle container and host protection — scanning, compliance, runtime defence, CNNF and WAAS — rather than whoever is free that week. You are told who is teaching before you commit, and that person is on the discovery call that shapes the agenda.
Where a batch is large enough to need a second trainer, the pairing is declared up front. The lead trainer stays accountable for the syllabus and the assessment either way.
Principal DevOps Engineer & Architect
Twenty years across DevOps, SRE and Security in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe, IBM/Emptoris, Ness, MindTree and Accenture. He has trained more than 10,000 engineers personally, at organisations including JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus. He teaches what he runs, not what he reads.
Teams of 8–30
Custom agenda, your timezone, onsite or online, NDA-friendly.
Request a quoteIndividual engineers
A private instructor and a curriculum built around your goal.
₹99,999Individuals who want peers
Scheduled batch, max 8 to 10 hours of live instruction.
₹34,999A private batch starts with a discovery call. We look at the stack you actually run — the CI system, the cloud, the constraints — and map the agenda onto it, so examples use your topology rather than a generic one.
Delivery is onsite at your premises, live online, or hybrid, scheduled around your release calendar rather than ours. Batches run 8 to 30 engineers.
Every attendee leaves with recordings, slides, lab repositories and a completion certificate. You receive an attendance and assessment report. Invoicing supports PO and GST.
Talk to us about a private Twistlock batchTwistlock is a commercial container and cloud workload protection platform, now shipped by Palo Alto Networks as Prisma Cloud Compute after its acquisition. It covers the whole lifecycle of a containerised workload in one product: scanning images in a registry and in a build pipeline, checking hosts and clusters against compliance benchmarks, enforcing what a running container is permitted to do, and controlling the network and web traffic around it.
Architecturally it is two components. The Console is the management plane — policy, results, reporting and API. Defenders are agents deployed as a DaemonSet on every node, or as host, serverless and app-embedded variants, and they do the actual work of scanning local images, evaluating compliance and enforcing runtime rules. Policy is authored centrally and evaluated by the Defender, which means enforcement continues even if the Console is briefly unreachable, and it means the Defender's resource footprint on a busy node is a real operational consideration.
What distinguishes Twistlock from a scanner is the runtime half. It builds behavioural models of a workload — the processes it normally executes, the files it touches, the network peers it talks to — and treats deviation as an incident rather than requiring somebody to write every rule by hand. On top of that sit two enforcement layers: a cloud native network firewall that governs container-to-container and egress traffic, and a web application and API layer that inspects HTTP traffic for injection, bot activity and API abuse. The result is a single policy surface spanning build, deploy and run, which is also the reason it needs careful configuration — an over-broad blocking policy in this product stops production, not just a build.
Container platforms grew faster than the controls around them. Most organisations now run business-critical workloads on Kubernetes or a managed equivalent, and the security question moved from whether images are scanned to whether there is a single, enforceable posture across build, registry, cluster, host and serverless — with evidence for each.
Commercial platforms exist because that consolidation is genuinely hard to assemble from parts. A team can combine an image scanner, a benchmark tool, a runtime detector and a network policy engine, but then owns four integrations, four policy models and four sets of results. Twistlock and its Prisma Cloud Compute successor sell one policy surface and one audit trail across all of it, which is why they appear in regulated environments where evidence consolidation matters as much as detection.
The practical demand is for engineers who can operate the platform rather than demo it. Deploying Defenders is straightforward; deciding which vulnerability policy blocks a build versus raises an alert, moving runtime rules from learning into prevention without breaking a release, sizing Defenders on busy nodes, and configuring the network and web layers so they protect traffic without dropping legitimate requests are the parts that determine whether the investment produces security or produces tickets.
How the product is put together and what that implies operationally. Console and Defender responsibilities, the Defender types and where each belongs, communication and certificate handling, sizing on busy nodes, and what continues to work when the Console is unreachable.
Topics: Console and Defender responsibilities and the split between them · Container, host, serverless and app-embedded Defenders · Deploying Defenders as a DaemonSet and on standalone hosts · Console deployment options, persistence and high availability · Communication, certificates and Defender registration · Resource footprint and sizing on high-density nodes · Behaviour during Console outage and Defender disconnect · Licensing model and how it counts workloads
The same image scanned at three points, and the policy that decides what happens at each. Registry scanning, build-phase scanning with twistcli, and continuous scanning of running containers and hosts — then vulnerability policy built on severity, fix availability and exposure rather than raw counts.
Topics: Registry scanning: scope, scheduling and credential handling · Build-phase scanning with twistcli and pipeline failure behaviour · Continuously scanning deployed containers and hosts · Serverless function and image scanning · Vulnerability data sources, feeds and air-gapped updates · Policy design: severity, fix availability, grace periods and exceptions · Alert versus block, and choosing per pipeline and per environment · Reconciling registry, build and runtime findings that disagree
Turning benchmark requirements into continuously evaluated checks. Built-in compliance checks for hosts, images, containers and clusters, custom checks for organisation-specific requirements, and compliance policy that produces evidence rather than a one-time report.
Topics: Built-in compliance checks for images, containers, hosts and clusters · CIS Docker and Kubernetes benchmark coverage · Compliance policy: which checks alert, which block · Writing custom compliance checks · Compliance templates for regulated control sets · Exceptions with justification and expiry · Trusted images and registry trust groups · Reporting compliance state over time
Putting the platform in the delivery path. twistcli in a pipeline, plugin-based integration with common CI systems, deciding what a failing scan does to a build, and gating promotion into a trusted registry so that only reviewed images can be deployed.
Topics: twistcli: image scan, host scan, serverless scan and output formats · CI plugin integration and pipeline stage placement · Pipeline failure thresholds and developer feedback quality · Scan result publishing back to the Console · Trusted images and blocking untrusted registries at admission · Promotion gates between registries and environments · Scanning base images and managing a golden base image · Handling scan latency inside a build time budget
The half that operates after deployment. Behavioural models built by observing a workload, the process, file, network and system-call rule dimensions, and the progression from learning through alerting to prevention — plus the incident view and forensic data you use when something fires.
Topics: How behavioural models are learned and when they are rebuilt · Container runtime rules: process, filesystem, network, system calls · Host runtime rules and Defender coverage of the node itself · Serverless and app-embedded runtime protection · Learning, alerting and preventing — moving a workload between them · Handling short-lived and highly dynamic workloads · Incident explorer, forensics and event reconstruction · Tuning to remove false positives without disabling protection
Controlling traffic rather than processes. The cloud native network firewall governing container-to-container and egress connections, radar views for understanding actual traffic before writing rules, and the web application and API layer inspecting HTTP for injection, bot and API abuse.
Topics: Radar views and mapping real traffic before writing any rule · Cloud native network firewall: east-west and egress control · Learning network behaviour and converting it into policy · DNS and outbound destination control · Web application and API protection: deployment modes and placement · Injection, bot and API abuse protections, and their false positive profile · API discovery and endpoint-level policy · Rolling web protection from detection into prevention safely
Multi-team operation. Collections and scoping so each team sees its own workloads, RBAC and SAML, alert profiles that route the right finding to the right destination, credential management, upgrades, and the reporting that keeps the platform funded and current.
Topics: Collections and scoping across teams, clusters and environments · RBAC roles, permission design and least privilege in the Console · SAML and identity provider integration · Alert profiles and routing to SIEM, chat and ticketing · Credential store and cloud account onboarding · Console and Defender upgrade paths and version skew · API and automation for policy as code · Reporting to engineering and to management without vanity metrics
We rebuild the agenda around the tools you actually run.
Request a custom agendaDeploy the Console and Defenders across a cluster and standalone hosts, then disconnect a Defender and document precisely what still enforces and what stops.
Scan the same image at build, in the registry and at runtime, explain every discrepancy, and write a policy that blocks only fixable critical findings.
Bring a failing host to a passing CIS benchmark state, add two custom checks, and prove drift is detected and reported.
Build behavioural models for a workload, tune the process, file and network dimensions, and switch to prevent mode without blocking legitimate behaviour.
Use radar views to establish real east-west and egress traffic for an application, then write network rules that match reality and block everything else.
Scope collections and RBAC for two teams, route alerts to a SIEM and a ticketing system, and put policy under version control through the API.
Billed yearly at ₹9,996
Max 8 to 10 hours of live instruction
Full program, private instructor
8–30 engineers · custom agenda · onsite or online · PO and GST invoicing
Refunds. If we cancel or postpone a cohort, you get a full refund within 15 days. There is no money-back guarantee otherwise.
Terms. Course material remains licensed to the attendee. Read the terms.
Your data. We don't share it with third parties. Privacy policy.
Certificate of completion
Rajesh is a very good trainer I have experienced in DevSecOps training. The number of contents in different topics he has posted on the DevOpsSchool public website are amazing and user friendly for beginners and experienced professionals.
Rajesh's experience and knowledge are exceptional and we learnt invaluable practical knowledge which we can apply in our production environment. Incredibly friendly and gave us a fantastic insight both in-depth and at a high level of the Rundeck product.
Great learning experience from a very knowledgeable instructor with well-prepared course notes. The lab exercises on AWS instance work well to learn the hands-on side of the course.
The trainer (Rajesh) provided very good sessions on SRE profession. Not only hands-on learning on the tools but also SRE mindset.
Very good training session. Well explained from the basics to the complex concepts. Also tried to cover practicals and demos within the 3 hour sessions. The learning content and videos are of a great deal of help.
Basics explanation was exemplary from Rajesh where he dealt with complicated topics to be simple. Great learning stuff personally for me.
| What matters | YouTube + blogs | Generic online course | Freelance marketplace | DevOpsSchool |
|---|---|---|---|---|
| Named practitioner | No | Rarely | Varies per booking | Yes — same trainer each time |
| Production experience | Unknown | Unknown | Unverified | 20 years, named employers |
| Custom agenda | No | No | Sometimes | Built from your stack |
| Onsite delivery | No | No | Sometimes | Yes |
| Lab environment | None | Sandbox that expires | Varies | Your own cloud — skill goes with you |
| Assessment | None | Quiz | Rarely | Assignments + capstone per module |
| Per-attendee certificates | No | Sometimes | Rarely | Yes |
| Corporate invoicing | No | Limited | Varies | PO and GST |
| Post-training support | None | Forum, time-limited | None | Lifetime forum access |
Tell us the team, the stack and the timeline. You'll get a straight answer, not a sales sequence.
Talk to an advisorPrefer to call or email?
More ways to reach us on the contact page.