Career path

DevSecOps Engineer

Build security into every stage of software delivery, from code to runtime, so that shipping fast and shipping safely stop being at odds, and steer the practice by measurement.

Aim for this jobWhat this job does

• 7 responsibilities
• 18 missions
• 77 skills
• 343 hours of work an estimate, starting from zero

Your gap

What you are missing

Aiming for this job computes your path from what you have already read and passed (quizzes, labs). You then see everything that remains from your first step.

466

lessons

~343 h

from zero

Aim for this job

Saved in this browser. Can be changed at any time.

The job

What a DevSecOps Engineer does

Seven responsibilities. Each one is carried out through concrete missions, which require skills.

1

Describe and harden infrastructure as code

Do on your own 3 missions · 15 skills

Missions that make it up

• Configure a fleet as code

  Deliverableservers configured by idempotent Ansible roles, replayed without drift

  • Predict what an IaC tool will create, change or destroy: declarative model, idempotence, state and plan
  • Write a readable, idempotent Ansible playbook
  • Parameterise an Ansible playbook: variables, facts, precedence and Jinja2 filters
  • Structure Ansible into roles and collections

  4 skills No lab yet

• Measure the compliance of a server and its infrastructure code

  Deliverablea server and infrastructure code measured against a baseline (ANSSI, CIS), their gaps prioritised

  • Measure a server's gap to a hardening baseline and prioritize the measures (ANSSI-BP-028, CIS)
  • Harden the build, the images and the IaC

  2 skills No lab yet

• Describe infrastructure as shareable, replayable code

  Deliverablean infrastructure split into versioned modules, its state shared and locked, replayed identically

  • Predict what an IaC tool will create, change or destroy: declarative model, idempotence, state and plan
  • Keep an IaC repository healthy: layered structure, plan review, testing pyramid and secrets out of the code
  • Structure infrastructure as code at scale: stacks, versioned modules, environments and debt
  • Share a remote, locked and recoverable Terraform state
  • Consume and version Terraform modules reproducibly
  • Design, structure and test a reusable Terraform module

  6 skills Proof lab

Also required, outside missions

• Administer a systemd service
• Protect the secrets of an Ansible project: Ansible Vault and external vaults
• Troubleshoot and run Ansible in production: verbosity, debugger, idempotence and ansible-pull
• Handle sensitive data in Terraform without exposing it in outputs or state

2

Hold production: vulnerabilities, reliability, incidents

Do on your own 3 missions · 9 skills

Missions that make it up

• Handle a vulnerability from detection to fix

  Deliverablea vulnerability detected, triaged, fixed or recorded as a dated exception, the image rebuilt

  • Analyze code and dependencies
  • Triage vulnerabilities and date the exceptions
  • Harden the build, the images and the IaC

  3 skills Proof lab

• Hold production over time

  Deliverabledated exceptions in VEX, an alerting SLO, a runbook, the DORA metrics

  • Triage vulnerabilities and date the exceptions
  • Observe, respond to incidents, hold an SLO

  2 skills Proof lab

• Respond to a security incident

  Deliverablea security incident contained, its traces reconstructed, its cause and actions documented

  • Respond to an incident and write a postmortem
  • Detect and contain at runtime
  • Trace who acted on the API with the Kubernetes audit log

  3 skills No lab yet

Also required, outside missions

• Detect an exposed secret, measure the reach of the leak and deal with it
• Troubleshoot a failing application on Kubernetes

3

Secure the software supply chain

Do on your own 4 missions · 22 skills

Missions that make it up

• Centralize user identity on an identity provider

  Deliverablea persistent identity provider with its realm, users, groups, roles and event logs, and an application connected with OpenID Connect whose tokens are validated

  • Set up Keycloak on PostgreSQL and administer a realm: users, groups, roles and event logs
  • Connect an application to an identity provider with OpenID Connect, validate its tokens and troubleshoot an OIDC or SAML integration

  2 skills No lab yet

• Provide secrets and identities to applications

  Deliverableeach application with a minimal identity and vault access limited to its paths, its secrets issued with a bounded lifetime or mounted from a Kubernetes Secret, never written into its image or manifests

  • Store a secret in a vault and read it without ever writing it in clear
  • Scope access to a vault to the strict minimum and explain a denial
  • Issue a secret with a bounded lifetime, renew it and revoke it in an emergency
  • Configure an application with ConfigMaps and Secrets
  • Give a workload a minimal identity (ServiceAccount)

  5 skills No lab yet

• Deliver a traceable artefact

  Deliverablea hardened image, its SBOM and a provenance attestation

  • Read an OCI image and check its integrity: index, manifest, config, layers and digests
  • Secure the installation and the containers
  • Harden the build, the images and the IaC
  • Produce an artifact's SBOM and qualify its vulnerabilities with a VEX
  • Publish an image to a registry: access token, tag, digest and publishing from CI
  • Sign an artifact, attest its provenance and verify it before deployment

  6 skills Proof lab

• Harden the delivery chain

  Deliverableblocking secrets and SAST checks, keyless OIDC identity, audited workflows

  • Analyze code and dependencies
  • Replace the shared secret with a verifiable machine identity (OIDC)
  • Spot the risks of a delivery chain
  • Secure a pipeline definition: permissions, secrets, pinning and triggers
  • Audit a CI workflow and model its threats

  5 skills Proof lab

Also required, outside missions

• List a system's secrets, rank them by criticality and keep their register
• Assess your software supply chain's exposure and respond to a compromised component
• Analyse an application with specialised scanners: secrets, SAST, dependencies, Scorecard and DAST
• Analyse an attack on a pipeline: secrets, hijacked tools and provenance

4

Analyse an application's risk

Do on your own 1 mission · 3 skills

Missions that make it up

• Model the application's threats

  Deliverablea STRIDE model of notes-api, checked by the pipeline

  • Threat-model an application
  • Write a first pipeline and read its failures

  2 skills Proof lab

Also required, outside missions

• Think DevSecOps: risks, responsibilities, defense in depth

5

Build and run a delivery chain

Do on your own 5 missions · 26 skills

Missions that make it up

• Build a reliable pipeline

  Deliverablea pipeline that tests notes-api on every push and fails when a test breaks

  • Work with branches and merge
  • Build an OCI image
  • Write the integration stages in the repository and make them fail usefully
  • Write a first pipeline and read its failures

  4 skills Proof lab

• Deliver an application on Kubernetes from a specification

  Deliverablean application configured, probed, given a minimal identity, exposed and isolated, with no walkthrough

  • Expose an application with a Service, Ingress or Gateway
  • Configure an application with ConfigMaps and Secrets
  • Make a workload reliable: health probes and resources
  • Give a workload a minimal identity (ServiceAccount)
  • Isolate traffic between Pods with NetworkPolicies
  • Audit an application factor by factor (12-factor) on Kubernetes and fix its gaps

  6 skills Proof lab

• Deliver the same artefact to several environments

  Deliverablean artefact built once, promoted from staging to production reproducibly, under control and traceably, with configuration specific to each environment

  • Build an artifact once and promote it across environments
  • Update an application and roll back
  • Configure an application with ConfigMaps and Secrets
  • Make a workload reliable: health probes and resources
  • Design dynamic pipelines (variables, conditions, reuse)
  • Deliver to environments, artifacts included
  • Adapt manifests per environment with Kustomize
  • Change Kubernetes resources declaratively without drifting from Git

  8 skills No lab yet

• Deploy with GitOps

  Deliverablenotes-api deployed and promoted between two environments from Git

  • Deploy and observe an application on Kubernetes
  • Deploy an application with GitOps
  • Synchronize and promote across environments

  3 skills No lab yet

• Run a CI execution environment

  Deliverablea runner installed and equipped, running with controlled permissions, reaching the repository and the registry, whose system or network incidents can be diagnosed

  • Manage users, permissions and processes
  • Install and maintain software
  • Troubleshoot the network and read the logs
  • Operate and troubleshoot Docker containers: lifecycle, logs, inspection and daemon
  • Harden and isolate CI runners

  5 skills No lab yet

Also required, outside missions

• Read and transform data (JSON, YAML, APIs)
• Write a tested command-line tool

6

Control admission and protect the runtime

Do on your own 1 mission · 5 skills

Missions that make it up

• Refuse the unknown and contain the runtime

  Deliverablea cluster that only admits signed images, restricted pods and active detection

  • Detect and contain at runtime
  • Explain and inspect a Linux container's isolation: namespaces, cgroups, capabilities, seccomp
  • Harden a Pod's execution context (securityContext)
  • Control what reaches production and detect deviations at runtime
  • Make the cluster reject what breaks a security rule

  5 skills Proof lab

7

Measure and spread the practice

Design and improve 1 mission · 4 skills

Missions that make it up

• Measure and spread the DevSecOps practice

  Deliverabledelivery and security indicators tracked, a practice extended to several teams

  • Explain DevOps principles and spot an organisational anti-pattern
  • Choose the document type and its reader before writing
  • Choose a branching model and a delivery strategy
  • Measure and scale DevSecOps across the organization

  4 skills Proof planned, not open yet

The means

With which tools?

Choose your tools: the choice changes the lessons to read, never the responsibilities.

Continuous integration platform

GitHub Actions GitLab CI

GitOps tool

Argo CD Flux

Automation language

Python Go

Going further

Specialisations

Optional, measured apart from the job.

Write and enforce policies as code

• Write a correct Rego policy in OPA 1.x syntax, and predict what it returns
• Verify a Rego policy: tests, coverage, lint and CI checks
• Enforce Rego policies on configuration files in a CI pipeline

Test, ship and secure Ansible code

• Harden a host with Ansible: firewall, SELinux and kernel parameters
• Set up an Ansible development workstation: editor and static analysis
• Choose, install and verify Galaxy roles and collections
• Test an Ansible role with Molecule and pass the ansible-lint production profile
• Run a playbook in an Ansible Execution Environment with ansible-navigator
• Test an Ansible role in CI and publish it with a version on Galaxy
• Build, publish and troubleshoot an Ansible Execution Environment with ansible-builder

Confine and encrypt Kubernetes workloads

• Confine a container against the host kernel (seccomp, AppArmor)
• Isolate a Pod in a sandboxed runtime (RuntimeClass)
• Encrypt and authenticate traffic between Pods

Frame AI coding agents

• Scope a task given to Claude Code and check its result with a plan, a diff and tests
• Confine Claude Code's execution: permissions, secrets and sandbox
• Automate and extend Claude Code with hooks, skills and plugins
• Connect an MCP server to Claude Code and delegate to isolated subagents
• Take back control of a drifting Claude Code session and troubleshoot its configuration
• Deliver a complete project driven by Claude Code, one vertical slice at a time
• Run Claude Code without an interactive session, in CI, with the right model and cost

Run a secrets vault in production

• Run a vault in production: initialise, seal, back up and monitor it

Run and govern the identity provider, and connect Kubernetes and Vault to it

• Protect an API with OAuth 2 tokens: audience, scopes, machine access and choosing the flow of a client without a browser
• Require a second factor per group in Keycloak, with forced enrolment and recovery, and set a password policy compliant with NIST SP 800-63B-4
• Manage the account lifecycle in Keycloak with SCIM and Workflows, handle a departure and run an access review
• Run Keycloak in production: TLS proxy, restored backup, version upgrade, emergency access and a realm described in Terraform
• Connect the Kubernetes API server and Vault to an OIDC identity provider, turn token groups into limited rights and diagnose a denial

What the site does not cover yet

Risk management (SFIA BURM): handled at the level of an application, through the threat model, not of the organisation.

Responding to a security incident: being prepared (draft sec.incident.respond). Delivering a secret from a vault to a Kubernetes workload (External Secrets Operator, CSI): not taught, the secrets-kubernetes lesson joins the Kubernetes course (decision of 2026-10-14); vault, access, time-bounded secrets and leaks are in the core since 2026-10-14 (sec.secrets.*), unproven while the secrets labs are missing.

Steering the approach (level 4): declared, not demonstrated while the generaliser-devsecops case file is a prototype.

Around this job

Compare with another job →

All the skills →

×

See in the glossary →