careers
DevSecOps Engineer
Build the delivery pipeline so that the secure way is also the easy way.
A DevSecOps engineer automates security into how software is built, shipped and run: pipelines, infrastructure as code, containers and cloud controls. Where an AppSec engineer focuses on code and design, DevSecOps focuses on the machinery that carries it to production.
see this path on the journey mapA day in the job
- Own the CI/CD security controls: scanning stages, gates, signing, short-lived credentials.
- Review infrastructure as code and enforce policy before it reaches the cloud.
- Harden container images, clusters and runners, and keep them patched.
- Turn manual security reviews into automated, versioned checks that run on every change.
- Measure friction (build time, false positives) and remove it, so teams do not route around the controls.
Stage 1· Foundations
Know the pipeline, the identity model and the shift-left idea.
Study here
- CI/CD
- Shift-left
- Secrets Scanning
- IAM - identity and access
- Git workflows and code review
- The delivery lifecycle
Learn elsewhere
- Linux, networking and shell scripting
- Git and at least one CI system
- Docker basics: images, layers, registries
Build this
Build a CI pipeline for a small service that lints, tests, scans for secrets and publishes an image.
Stage 2· Practitioner
Automate the main checks and secure the infrastructure that runs the code.
Study here
- SAST
- SCA
- DAST
- Secure infrastructure as code
- CI/CD hardening
- Containers - images and supply chain
- CI pipelines that stay fast
- Infrastructure as code
- Containers and images
Learn elsewhere
- Terraform or another IaC tool, written for real
- Observability basics: metrics, logs, alerts
- A cloud provider's core services
Build this
Provision a small environment with IaC, scan the code and the plan, and deploy with short-lived credentials instead of stored keys.
Stage 3· Advanced
Treat security as a platform that teams adopt.
Study here
- SBOM
- DevSecOps
- Policy as code
- Kubernetes - secure runtime
- Security as an internal product
- Kubernetes fundamentals
- Release strategies and rollback
Learn elsewhere
- Site reliability practices: SLOs, incident response, release engineering
- Supply chain integrity: signing and provenance
- Developer experience as a discipline
Build this
Publish a paved-road template (pipeline + IaC module + policy) and measure how many teams adopt it and how long onboarding takes.
What to show
- A repository with a hardened pipeline: pinned dependencies, short-lived cloud credentials, signed artifacts.
- A set of policy-as-code rules with tests, showing what each one prevents.
- A before/after write-up of a pipeline where you removed friction and kept (or improved) coverage.
Certifications (examples)
- CKS (CNCF)
- AWS Certified Security – Specialty
- Azure Security Engineer Associate (AZ-500)
Examples, not endorsements or requirements. Check the issuer for current details.