Training: DevSecOps – Fundamentals

Ref. SEC-01

Download PDF

Duration:

jours

Exam:

Non certifiant

Level:

Intermédiaire

Funding:

Eligible

Home > Trainings > Development > DevOps > Observability, Security and Delivery > DevSecOps – Fundamentals

DevSecOps - Fundamentals Training

The DevSecOps – Fundamentals course introduces the essential principles of DevSecOps and helps you understand how to integrate security throughout the software lifecycle. In a context where build chains, dependencies, containers, infrastructures and automated deployments increase the exposure surface, DevSecOps aims to bring development, operations and security closer together around shared, continuous and industrialized practices.

A hands-on course to introduce security into your delivery workflows

Throughout this course, you will learn how to understand the principles of shift-left security, identify the main risks in a CI/CD chain, integrate security controls into development and deployment workflows, and better articulate security, automation and delivery. This course is an excellent gateway before more advanced approaches around GitLab, Kubernetes or industrialized DevSecOps chains.

Participant Profiles

DevOps engineers
Systems and platform administrators
Developers
Technical leads
Security engineers wishing to better understand DevOps practices
Technical and cloud architects

Objectives

Understand the fundamental principles of DevSecOps
Identify security risks in a modern delivery chain
Understand the concept of shift-left security
Introduce security controls into CI/CD workflows
Identify the main controls related to code, dependencies, images and deployments
Understand the basics of software supply chain security
Adopt a more integrated vision between development, operations and security

Prerequisites

Having general knowledge of software development or operations
Knowing the basics of Git and CI/CD
Understanding the general principles of cloud, container or automated environments
Prior exposure to security topics is a plus but not mandatory

Course Content

Module 1: Introduction to DevSecOps

Definition of DevSecOps
Differences between traditional security and security integrated into delivery
Why secure build and deployment chains
Organizational, technical and operational challenges

Module 2: Security principles in the software lifecycle

Shift-left security
Continuous integration of controls
Security of code, dependencies and configurations
Visibility, shared responsibility and continuous improvement

Module 3: Risks in a modern CI/CD chain

Risks related to code repositories
Risks related to CI/CD pipelines
Risks related to secrets and sensitive variables
Risks related to images, registries and artifacts
Risks related to automated deployments

Module 4: Essential security controls

Code analysis at an introductory level
Dependency control
Secrets management
Configuration compliance controls
Verification of images and artifacts
Principles of basic hardening

Module 5: DevSecOps and cloud native environments

Security in containerized environments
Security of automated infrastructure
Security principles in Kubernetes and modern platforms
Concepts of supply chain security
Overall vision of the controls to implement

Module 6: Best practices and progressive implementation

Introducing DevSecOps without blocking delivery
Prioritizing controls
Avoiding noise and false positives
Building a realistic DevSecOps roadmap
Concrete cases and feedback from experience

Documentation

Digital course materials included

Lab / Exercises

This course includes hands-on exercises designed to reinforce your knowledge and apply your skills in real-world professional scenarios.

Complementary Courses

Eligible Funding

ITTA is a partner of a continuing education fund dedicated to temporary workers. This fund can subsidize your training, provided that you are subject to the “Service Provision” collective labor agreement (CCT) and meet certain conditions, including having worked at least 88 hours in the past 12 months.

Additional Information

What is DevSecOps and why adopt it?

DevSecOps integrates security at every stage of the software life cycle, from design to production deployment, rather than pushing it to a final review. This approach significantly reduces the cost of vulnerabilities (early detection) and improves the overall security posture without slowing down delivery. In a context where regulatory requirements (GDPR, Swiss nFADP, NIS2) are tightening, DevSecOps has become a standard for mature IT teams.

Positioning within a DevOps learning path

This training targets profiles already familiar with DevOps (Git, CI/CD, containers) who want to add a security dimension to their practice. It pairs very well with GitLab CI/CD Advanced (GLB-02), Docker Administration (DOCK-02), Kubernetes (KUB-01, KUB-02) and Prometheus (PRM-01). For security-oriented Kubernetes profiles, it logically precedes the preparation for the CKS certification (KUB-14).

Why take this course rather than add tools over time?

Installing a SAST or DAST scan is easy; building a consistent security practice within a team is not. The training helps you understand where each control belongs in the pipeline, how to prioritize vulnerabilities, how to manage secrets, and how to have Dev, Ops and Security collaborate without friction. You leave with a structured approach, not a collection of tools.

Practical tips to implement DevSecOps

Start with the highest impact: automated dependency scanning and solid secret management. Do not try to enable everything at once: each control generates noise that needs to be triaged. Involve security from the pipeline design stage to avoid team pushback. Measure results (fixed vulnerabilities, time to remediation) to demonstrate value.

FAQ

Do I need to be a cybersecurity expert to attend?

No. The training is designed for DevOps profiles who want to add security to their practice. General security awareness is useful but not mandatory.

Which tools are covered in practice?

The training covers tools representative of each category (SAST, DAST, SCA, container scanning, secret management, policy as code). The goal is to understand the categories rather than become an expert in a specific product.

Does DevSecOps replace a security audit or pentest?

No, it complements them. DevSecOps detects early and reduces common vulnerabilities; audits and pentests still play their role on complex attack scenarios and certifications.

Can the training be applied beyond Kubernetes?

Yes. The principles (shift left, automation, policy as code, secret management) apply to any DevOps chain, even outside Kubernetes. Kubernetes labs remain examples among others.