DevSecOps Engineering: Secure CI/CD Pipelines

• Build a CI/CD pipeline with security gates that developers accept
• Integrate SAST, SCA, secret and IaC scanning
• Harden container images and build environments
• Manage pipeline secrets and least-privilege runners
• Produce a supply-chain security baseline

1. 1

   DevSecOps Principles

   Shift left without shifting pain.

   • Pipeline threat model
   • Gate design
   • Developer experience

   Open module
2. 2

   Build Your Pipeline

   A real repo, a real pipeline.

   • Repo and workflow setup
   • Runner security
   • Environment separation

   Open module
3. 3

   Code & Dependency Security

   Catch it before it ships.

   • SAST integration
   • SCA and SBOM generation
   • Triaging findings
   • Suppression policy

   Open module
4. 4

   Secrets & Credentials

   Stop leaking the keys.

   • Secret scanning
   • Vault-backed injection
   • Rotation and revocation

   Open module
5. 5

   Container & IaC Security

   Harden what you deploy.

   • Image hardening
   • Container scanning
   • Terraform policy checks
   • Kubernetes manifests

   Open module
6. 6

   Supply Chain & Release Integrity

   Trust what you ship.

   • Artifact signing
   • Provenance
   • Release approval gates
   • Pipeline monitoring

   Open module

PrimeSec does not hand you a pre-built machine. You get professional lab guides and build the environment yourself — that is where the skill comes from.

• Create a pipeline that builds and tests a sample app
• Add SAST and triage the first findings
• Generate an SBOM and flag vulnerable dependencies
• Enable secret scanning and remediate a planted secret
• Scan and harden a container image
• Block a non-compliant Terraform change
• Sign a build artifact and verify it

• A hardened reference pipeline repository with documentation
• A security gate policy defining thresholds and exceptions
• A supply-chain security assessment of your own pipeline