DevSecOps Practitioner E-Learning Training

Develop advanced software security skills with the DevSecOps Practitioner E-Learning Training. Learn to integrate security into CI/CD pipelines, application testing, containers, Kubernetes, and Infrastructure as Code (IaC). This training includes 8 e-learning modules and a final assessment, covering secrets management, Compliance as Code, runtime threat detection, and continuous risk management.

The DevSecOps Practitioner Training develops practical skills in integrating security throughout the software development lifecycle. Learn to secure software delivery pipelines, automate security testing, protect cloud-native applications, and implement continuous compliance and governance.

This LearningKit with more than 11 hours of learning is divided into three tracks:

Course Outcome

DevSecOps Practitioner: Secure Pipelines

Course: 1 Hour, 6 Minutes

• Course Overview
• What Is DevSecOps?
• Architecture of a Secure CI/CD Pipeline
• Supply-Chain Risks and Prevention Strategies
• Implement Multi-Stage Validation
• Common Pitfalls in Pipeline Security
• Integrate Vulnerability Scanners and Linters
• Generate and Validate SBOMs
• Building Multi-Stage Validation Gate in GitHub Actions
• Integrating Snyk and Trivy Scanners in Jenkins
• Course Summary

DevSecOps Practitioner: Advanced Static and Dynamic Analysis

Course: 1 Hour, 11 Minutes

• Course Overview
• SAST vs. DAST
• Anatomy of a SAST Scan Workflow
• Anatomy of a DAST Scan Workflow
• Selecting the Right Tools
• Automation of Tests in CI/CD
• Simulation of Real‑World Attacks in Pre‑Production
• Integration of Test Results with Developer Feedback
• Analysis and Remediation Workflows
• Integrating Snyk SCA/SAST with GitHub Actions
• Running ZAP Baseline Scan in CI
• Course Summary

DevSecOps Practitioner: Container and Kubernetes Security

Course: 1 Hour, 6 Minutes

• Course Overview
• Harden Container Runtime Environments
• Applying seccomp and AppArmor Profiles
• Enforce Pod Security Standards
• Kubernetes RBAC and Network Policies
• Use Kube-bench and Falco for Monitorting
• Secure Ingress/Egress Traffic Handling
• Scan Kubernetes Manifests and Helm Charts
• Container Image Supply Chain Security
• Enforcing Restricted Admission Policies
• Course Summary

DevSecOps Practitioner: Infrastructure as Code (IaC) Security

Course: 1 Hour, 15 Minutes

• Course Overview
• Security Challenges in Infrastructure as Code (IaC)
• Static Scanning with tfsec and Checkov
• Early Detection of Misconfigurations
• Secret Leakage Detection in IaC
• Implementing tfsec in GitHub Actions
• Secure Deployment Workflows for Cloud
• Pull Request (PR) Validation Gates
• Writing Policy as Code with OPA and Rego
• Governance and Drift Detection
• Course Summary

DevSecOps Practitioner: Secrets and Credential Management at Scale

Course: 1 Hour, 48 Minutes

• Course Overview
• Secret Sprawl – Risks and Breach Case Studies
• Inventory and Discovery – Hunting Leaked Secrets
• Centralized Secret Stores – Design Patterns
• HashiCorp Vault Basics
• Cloud‑Native Secret Managers
• CI/CD Integration – Injecting Secrets Securely
• Automated Rotation and Revocation Workflows
• Enforcing Least-Privilege and Multi-Factor Authentication (MFA)
• Secrets in Containers and Orchestrators
• Auditing and Monitoring Secret Usage
• Incident Response: Containing a Secret Leak
• Performing Secret Scans in Git Repositories
• Configuring Vault Setup and App Authentication
• Managing Automated Rotation with AWS Secrets Manager
• Course Summary

DevSecOps Practitioner: Compliance as Code

Course: 1 Hour, 31 Minutes

• Course Overview
• Policy as Code Fundamentals
• Regulatory Landscape and DevSecOps Alignment
• Open Policy Agent (OPA) and Rego
• Chef InSpec Profiles
• AWS Config and Security Hub
• Azure Policy and Defender for Cloud
• Terraform Sentinel Policies and Run Tasks
• Continuous Compliance in CI/CD Pipelines
• Automated Reporting and Evidence Collection
• Writing and Testing Rego Policies with OPA
• Automating Compliance Scans with InSpec
• Enforcing Sentinel Policies in Terraform Cloud
• Course Summary

DevSecOps Practitioner: Runtime Threat Detection & Response

Course: 1 Hour, 34 Minutes

• Course Overview
• Understanding the Runtime Threat Surface
• eBPF & Syscall Monitoring Basics
• Falco Rule Syntax Deep Dive
• Integrating SIEM with Kubernetes
• Threat-Intelligence Feeds in DevSecOps
• Cloud-Native IDS Options
• Automating Alert Triage with SOAR
• Runtime Policy Enforcement via OPA/Gatekeeper
• Incident Response Playbooks
• Case Study: Container Breakout Detection
• Installing Falco on Kubernetes
• Configuring AWS GuardDuty & Investigating Findings
• Live IR Drill with Elastic SIEM
• Course Summary

DevSecOps Practitioner: Continuous Governance & Risk Management

Course: 1 Hour, 36 Minutes

• Course Overview
• Governance Frameworks 101
• Translating Controls to Code
• OPA Policy Lab
• Continuous Controls Monitoring
• Drift Detection Strategies
• Cloud Custodian Guardrails
• Risk Scoring & Dashboards
• Evidence Automation Pipelines
• Incident Metrics & Learning Loops
• Automated Audit Snapshot
• Resilience & Business Continuity Tie-In
• Governance Program Maturity Roadmap
• Course Summary

1. Secure CI/CD Pipelines

• DevSecOps principles and secure CI/CD architecture
• Security controls across build, test, and deployment
• Static and Dynamic Application Security Testing (SAST/DAST)

2. Container, Kubernetes, and IaC Security

• Container security and Kubernetes hardening
• RBAC, network policies, and Pod Security Standards
• Infrastructure as Code (IaC) security
• Preventing misconfigurations and privilege escalation

3. Secrets Management and Compliance

• Managing passwords, API tokens, and credentials
• Compliance as Code and Policy as Code
• ISO 27001, NIST 800-53, PCI DSS, and SOC 2

4. Runtime Security and Governance

• Runtime threat detection and response
• Security monitoring and incident response
• Continuous governance and risk management
• Automated security and compliance controls

5. Final Assessment

• Final Exam: DevSecOps Practitioner

Who Should Attend?

DevOps Engineers, DevSecOps Professionals, Security Engineers, Software Developers, Cloud Engineers, Cybersecurity Specialists, and IT professionals interested in securing modern software delivery.

Prerequisites

Basic knowledge of DevOps, CI/CD, software development, cloud environments, and cybersecurity is recommended. No formal prerequisites are specified.

Start your DevSecOps Practitioner E-Learning Training with OEM Office Elearning Menu and develop essential skills in secure software development, cloud-native security, and automated compliance.