Course Objective & Scope
Manual penetration tests right before release cannot keep pace with modern delivery and multiply the cost of fixing defects. This programme teaches how to embed automated security checks into every stage of the software delivery and CI/CD lifecycle.
Secret scanning with Gitleaks, SAST with Semgrep/SonarQube, SCA and SBOM generation with Trivy/Dependency-Track, IaC scanning with Checkov, DAST with OWASP ZAP and vulnerability triage with DefectDojo are practised hands-on. Participants build automated security gates inside a sample pipeline.
Who Should Attend?
- DevOps and platform engineers building and maintaining CI/CD pipelines
- Application security (AppSec) and product security specialists
- Software developers and tech leads responsible for secure delivery
- Prerequisite: basic Git and CI/CD pipeline familiarity
Key Takeaways
- Embed automated security scans into CI/CD pipelines without slowing down developers
- Catch leaked API keys and credentials at commit time using Gitleaks and TruffleHog
- Run SAST, SCA, container and IaC scanners and tune out false positives
- Generate SBOMs to track open-source dependency and licence risks continuously
- Design security quality gates and exception workflows that block critical vulnerabilities
Curriculum
DevSecOps Culture, Threat Modelling and Shift-Left
- Placing security controls across the SDLC and the Security Champions model
- Lightweight threat modelling (STRIDE) and security requirements
Code and Dependency Security: Secret Scanning, SAST and SCA
- Catching secrets at pre-commit and CI time with Gitleaks
- Static application security testing (SAST) with Semgrep and SonarQube
- Software composition analysis (SCA) and CycloneDX/SPDX SBOM generation
Container, IaC and Supply Chain Security
- Scanning Dockerfiles, Terraform and Kubernetes manifests with Checkov and Trivy
- The SLSA framework, artefact signing with Cosign and CI runner hardening
Dynamic Testing (DAST) and API Security Checks
- Automated DAST scanning with OWASP ZAP and Nuclei
- API security testing driven by OpenAPI schemas
Security Quality Gates and Vulnerability Triage
- SARIF reports, DefectDojo integration and prioritisation (EPSS/CVSS)
- Pull-request policies, breaking security gates and enterprise checklist
Other Courses in This Category
-
GitOps on Kubernetes with Argo CD and Flux: declarative state management, drift detection and automated reconciliation, Kustomize and Helm integration, multi-cluster delivery with ApplicationSets, Secret management and progressive delivery.
- Live Course
- 5 modules
-
Infrastructure as Code (IaC) with Terraform/OpenTofu and Ansible: declarative provisioning, remote state and locking, reusable modules, policy-as-code, testing, CI/CD automation and configuration management.
- Live Course
- 5 modules
-
Modern CI/CD pipeline design with GitHub Actions, GitLab CI and Jenkins: branching strategies, fast builds and caching, automated testing and quality gates, container/artefact versioning and zero-downtime deployment.
- Live Course
- 5 modules
-
Platform Engineering and Internal Developer Platform (IDP) design with a product mindset: golden path templates, Backstage developer portals, self-service infrastructure with Crossplane/Terraform, reducing cognitive load and DORA/SPACE metrics.
- Live Course
- 5 modules
-
Site Reliability Engineering (SRE) fundamentals: defining SLIs, SLOs and error budgets, reducing toil through automation, symptom-based monitoring and multi-window burn-rate alerts, on-call incident management and blameless postmortems.
- Live Course
- 5 modules
-
PowerShell 7 and Windows PowerShell for sysadmins and DevOps teams: the object pipeline, WMI/CIM, PowerShell Remoting, Active Directory and Microsoft Graph/Azure automation, module authoring and secure execution.
- Live Course
- 5 modules
Get in touch
