Subject Overview

An advanced study of integrating security across DevOps culture, architecture, software supply chains, CI/CD pipelines, cloud platforms and operations. The subject combines technical controls with risk-based governance, metrics, leadership, automation, AI and contemporary regulatory and industry practices.

Learning Goal

Graduates will be able to design, implement, evaluate and lead secure DevOps programs and pipelines; automate risk-informed controls; protect software supply chains and cloud-native environments; manage incidents, compliance and metrics; and make ethical, strategic decisions concerning emerging security technologies.

Syllabus

1. DevSecOps Foundations, Culture and Terminology

Learning Objective: Explain DevOps and cybersecurity foundations, shared-responsibility culture, shift-left and shift-right security, continuous assurance, Zero Trust principles, security debt and the people-process-technology operating model.

Category: foundation

2. Secure Software Development Lifecycle and Threat Modeling

Learning Objective: Integrate security requirements, abuse cases, data classification, privacy and architecture reviews into agile delivery; apply threat-modeling methods such as STRIDE, attack trees and MITRE ATT&CK-informed analysis.

Category: core

3. Risk Management, Governance and Compliance

Learning Objective: Translate business risk and regulations into pipeline controls using frameworks such as NIST CSF, NIST SSDF, ISO 27001, SOC 2 and OWASP SAMM; define policies, accountability, evidence, exceptions and risk acceptance.

Category: strategic

4. Identity, Access, Secrets and Cryptographic Controls

Learning Objective: Design least-privilege access using IAM, RBAC/ABAC, federation, MFA, workload identities, privileged access management, secrets vaults, key rotation, PKI, encryption and machine-identity governance.

Category: core

5. Secure Source Control and Developer Workstations

Learning Objective: Protect repositories, branches, commits, code reviews and developer environments through access controls, signing, secret detection, endpoint security, secure coding standards and insider-threat safeguards.

Category: application

6. Security Engineering in CI/CD Pipelines

Learning Objective: Architect hardened pipelines with isolated runners, trusted build environments, policy gates, artifact integrity, separation of duties, ephemeral credentials, auditable approvals and secure deployment patterns.

Category: core

7. Automated Application Security Testing

Learning Objective: Select, integrate and interpret SAST, DAST, IAST, SCA, API, fuzz, container and infrastructure-as-code testing; manage false positives, exploitability, remediation prioritization and developer feedback loops.

Category: application

8. Software Supply Chain and Artifact Security

Learning Objective: Secure dependencies, package registries, build systems and artifacts using SBOMs, provenance, signing, attestations, SLSA, reproducible builds and vulnerability disclosure while addressing third-party and open-source risk.

Category: core

9. Infrastructure as Code, Containers and Kubernetes Security

Learning Objective: Securely configure and assess Terraform-style infrastructure, images, registries, containers and Kubernetes using scanning, admission controls, runtime policies, network segmentation and CIS-aligned hardening.

Category: application

10. Cloud-Native Security and Platform Engineering

Learning Objective: Apply shared-responsibility models, cloud security posture management, workload protection, policy as code, service-mesh controls, secure landing zones and platform engineering to multi-cloud and serverless environments.

Category: advanced

11. Runtime Security, Observability and Incident Response

Learning Objective: Implement telemetry, SIEM/SOAR integration, anomaly detection, runtime protection and continuous control monitoring; conduct triage, containment, forensics, recovery, post-incident learning and pipeline compromise response.

Category: application

12. Vulnerability Management, Metrics and Security Analytics

Learning Objective: Build risk-based vulnerability programs using asset context, CVSS, EPSS, threat intelligence and service-level objectives; evaluate KPIs/KRIs, control effectiveness, remediation economics and executive dashboards.

Category: strategic

13. DevSecOps Strategy, Operating Models and Leadership

Learning Objective: Develop maturity roadmaps, security-champion networks, product-team accountability, investment cases, vendor strategies and transformation plans; manage organizational resistance, skills, incentives and measurable business outcomes.

Category: strategic

14. AI, Ethics and the Future of DevSecOps

Learning Objective: Evaluate AI-assisted coding, security copilots, autonomous remediation and ML pipeline threats; govern privacy, bias, explainability, intellectual property and human oversight while assessing post-quantum security and emerging regulatory trends.

Category: contemporary