// roadmap/devsecops
DevSecOps Roadmap
Build security into every step of how you ship, in 6 stages: security basics, secure code, CI/CD, containers, cloud and security operations. Each topic links to our guides and posts to read and to simulators, labs and checklists to practice with. Your progress stays in this browser.
- 6 stages
- 30 topics
- 36-48 weeks
- 6 projects
- 87 links to our material
New to DevOps? Start with the Junior DevOps Roadmap.
$ roadmap status
- >Security Fundamentals, 0 of 5 topics done
- 02Secure Development, 0 of 5 topics done
- 03CI/CD Security, 0 of 5 topics done
- 04Container Security, 0 of 5 topics done
- 05Cloud Security, 0 of 5 topics done
- 06Security Operations, 0 of 5 topics done
$ roadmap next
stage 1, topic 1 of 5
$ roadmap last
Continue where you left off: nothing opened yet
// stage 01 of 06, 6-8 weeks
Security Fundamentals
Build your security foundation with core concepts and threat modeling.
Security Principles
essential~15 h
Learn CIA triad, defense in depth, least privilege, and zero trust concepts.
OWASP Top 10
essential~20 h
Understand the most critical web application security risks.
Threat Modeling
important~15 h
Learn STRIDE, DREAD, and attack tree methodologies.
read
Linux Security Basics
essential~20 h
File permissions, user management, SSH hardening, and firewall basics.
read
practice
Cryptography Essentials
important~15 h
Symmetric and asymmetric encryption, hashing, TLS/SSL, and PKI basics.
read
// stage project
Security Assessment Report
beginner
Perform a basic security assessment on a sample application using OWASP guidelines.
// after this stage you can
- Identify common security vulnerabilities
- Apply security principles to system design
- Conduct basic threat modeling sessions
- Understand encryption and authentication mechanisms
// tips
- Practice on intentionally vulnerable apps like DVWA or Juice Shop
- Join security communities like OWASP local chapters
- Read security breach post-mortems to learn from real incidents
// stage 02 of 06, 6-8 weeks
Secure Development
Shift security left by integrating security into the development process.
Secure Coding Practices
essential~25 h
Input validation, output encoding, parameterized queries, and error handling.
read
SAST Tools
essential~20 h
Static Application Security Testing with SonarQube, Semgrep, or CodeQL.
Dependency Scanning
essential~10 h
Find vulnerable dependencies with Dependabot, Snyk, or OWASP Dependency-Check.
read
Pre-commit Hooks
important~8 h
Implement security checks before code is committed using git hooks.
Code Review for Security
important~15 h
Learn to identify security issues during code reviews.
// stage project
Secure Code Pipeline
intermediate
Set up a CI pipeline with SAST, dependency scanning, and pre-commit security hooks.
// after this stage you can
- Write secure code following best practices
- Configure and interpret SAST tool results
- Manage vulnerable dependencies effectively
- Conduct security-focused code reviews
// tips
- Start with one SAST tool and learn it deeply before adding more
- Focus on reducing false positives to maintain developer trust
- Create security champions in each development team
// stage 03 of 06, 6-8 weeks
CI/CD Security
Secure your build and deployment pipelines from threats.
Pipeline Hardening
essential~20 h
Secure CI/CD configurations, runner isolation, and artifact signing.
read
practice
Secrets Management
essential~25 h
HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault for secure secrets.
read
practice
DAST Integration
important~20 h
Dynamic Application Security Testing with OWASP ZAP or Burp Suite.
read
Supply Chain Security
important~15 h
SBOM generation, artifact verification, and Sigstore/cosign.
read
Security Gates
essential~10 h
Implement quality gates that block deployments on security failures.
// stage project
Secure CI/CD Pipeline
intermediate
Build a complete pipeline with secrets management, DAST, and security gates.
// after this stage you can
- Design and implement secure CI/CD pipelines
- Manage secrets without hardcoding them
- Integrate dynamic security testing into deployments
- Generate and verify software bills of materials
// tips
- Treat pipeline configurations as code: version control and review them
- Never store secrets in environment variables visible in logs
- Use ephemeral build environments when possible
// stage 04 of 06, 6-8 weeks
Container Security
Secure containerized applications from build to runtime.
Image Security
essential~20 h
Build minimal images, scan with Trivy/Grype, and use trusted base images.
practice
Container Runtime Security
essential~20 h
Seccomp, AppArmor, read-only filesystems, and non-root users.
read
Kubernetes Security
essential~30 h
RBAC, Network Policies, Pod Security Standards, and admission controllers.
practice
Runtime Threat Detection
important~15 h
Falco, Sysdig, or Aqua for detecting anomalous container behavior.
practice
Service Mesh Security
nice to have~20 h
mTLS, authorization policies, and traffic encryption with Istio or Linkerd.
practice
// stage project
Secure Kubernetes Deployment
advanced
Deploy an application to Kubernetes with all security best practices implemented.
// after this stage you can
- Build and scan secure container images
- Implement container runtime hardening
- Configure Kubernetes security controls
- Monitor containers for security threats
// tips
- Start with Pod Security Standards before implementing custom policies
- Use distroless or scratch base images for production
- Implement network policies even in development environments
// stage 05 of 06, 6-8 weeks
Cloud Security
Secure cloud infrastructure and implement cloud-native security controls.
IAM Best Practices
essential~25 h
Least privilege, role-based access, and identity federation.
read
Infrastructure as Code Security
essential~15 h
Scan Terraform/CloudFormation with Checkov, tfsec, or KICS.
read
Cloud Security Posture
important~20 h
CSPM tools like Prowler, ScoutSuite, or cloud-native solutions.
read
Data Protection
essential~15 h
Encryption at rest and in transit, key management, and data classification.
Network Security
important~20 h
VPCs, security groups, WAF, and DDoS protection.
read
practice
// stage project
Secure Cloud Architecture
advanced
Design and implement a secure multi-tier cloud architecture following the Well-Architected Framework.
Start with:
// after this stage you can
- Design IAM policies following least privilege
- Scan infrastructure code for security issues
- Implement cloud security monitoring and compliance
- Secure data in cloud environments
// tips
- Get certified in your primary cloud provider (AWS/Azure/GCP)
- Use infrastructure as code for all cloud resources
- Enable CloudTrail/Activity Logs from day one
// stage 06 of 06, 6-8 weeks
Security Operations
Monitor, detect, and respond to security incidents effectively.
Security Monitoring
essential~25 h
SIEM concepts, log aggregation, and security dashboards.
practice
Incident Response
essential~20 h
IR playbooks, containment strategies, and post-incident reviews.
read
practice
Vulnerability Management
essential~15 h
Vulnerability scanning, prioritization, and remediation workflows.
read
Compliance Automation
important~20 h
Automate compliance checks for SOC2, PCI-DSS, HIPAA, or ISO 27001.
read
Security Metrics
important~10 h
Track MTTD, MTTR, vulnerability counts, and security debt.
// stage project
Security Operations Center
advanced
Set up monitoring, alerting, and incident response procedures for a production environment.
Start with:
// after this stage you can
- Set up centralized security monitoring
- Create and execute incident response plans
- Manage vulnerabilities across the organization
- Track and report on security metrics
// tips
- Start small. You cannot monitor everything from day one.
- Practice incident response with tabletop exercises
- Build relationships with development teams, not walls
// next
Keep going
- 9 stages, 47 topics, 20-29 weeksDevOps RoadmapThe full path, from your first Linux command to containers, pipelines, cloud, observability and security in production.
- 5 stages, 16 topics, 21-32 weeksJunior DevOps RoadmapThe essentials for a first DevOps role: Linux and Git, then containers, CI/CD and the cloud.
Found a wrong link or a missing topic? Open an issue on GitHub.