DevSecOps & Security Automation
Shift security left — secure SDLC, SAST/DAST/SCA in CI/CD, secrets management, supply-chain security, IaC scanning, and detection engineering.
100% Free · All lessons unlocked
Course Content
Foundations
Core concepts and groundwork
Shift-left security and the DevSecOps culture shift
Reading
Secure SDLC — threat modelling at design time
Reading
CI/CD pipeline architecture and trust boundaries
Reading
Secrets management — Vault, AWS Secrets Manager and rotation
Reading
Supply chain security — SBOM and SLSA framework basics
Reading
Practice — build a threat model for a CI/CD pipeline
Exercise
Core Skills
Essential techniques and patterns
GitHub Actions / GitLab CI security hardening
Reading
Integrating SAST and SCA into pipeline gates
Reading
Container image signing and verification (Cosign, Notary)
Reading
Policy-as-code gates with OPA/Conftest in pipelines
Reading
Pipeline poisoning attacks and runner isolation
Reading
Practice — add SAST, SCA and image signing to a pipeline
Exercise
Applied Practice
Hands-on, real-world scenarios
Terraform security scanning — Checkov, tfsec and Terrascan
Reading
Policy-as-code with Open Policy Agent (OPA) and Rego
Reading
Drift detection and continuous compliance
Reading
Ansible and configuration management security
Reading
GitOps security model — ArgoCD and Flux trust boundaries
Reading
Practice — write OPA policies to block insecure Terraform
Exercise
Advanced Topics
Deeper, more complex material
Centralised logging architecture — ELK / OpenSearch stack
Reading
SIEM fundamentals — correlation rules and alert tuning
Reading
Detection engineering with Sigma rules
Reading
SOAR concepts — automated response playbooks
Reading
Building dashboards for security KPIs and MTTR
Reading
Practice — write Sigma detection rules and a SOAR playbook
Exercise
Production & Scale
Building for the real world
Incident response lifecycle — NIST 800-61 phases
Reading
Digital forensics basics — memory and disk artefacts
Reading
Threat hunting methodology and hypothesis-driven hunts
Reading
Cloud incident response — isolating a compromised workload
Reading
Post-incident review and lessons-learned process
Reading
Practice — run a tabletop incident response simulation
Exercise
Mastery & Capstone
Projects and final review
Project brief — DevSecOps pipeline with full detection stack
Reading
Build a CI/CD pipeline with SAST, SCA and image signing
Exercise
Deploy centralised logging and Sigma-based detections
Exercise
Simulate an attack and trigger automated response
Exercise
Capstone — submit DevSecOps pipeline portfolio project
Project
100% Free · All lessons unlocked
Topic Overview
What you'll learn
- Core concepts and fundamentals of DevSecOps & Security Automation
- Industry best practices and design patterns
- Hands-on exercises with real-world scenarios
- Performance optimization and advanced techniques
- Building production-ready applications