A free, practical roadmap for learning how to build, secure, and operate modern software delivery pipelines. It covers Linux, Git, CI/CD, secure coding, containers, Kubernetes, infrastructure as code, cloud security, software supply chains, and security automation.
No paid course is required. Use the phases in order, but keep building small projects throughout.
DevSecOps integrates security into the development and operations lifecycle instead of leaving it until the end. A mature workflow makes security continuous:
Plan → Code → Build → Test → Scan → Release → Deploy → Monitor → Respond
The goal is not to block developers with endless alerts. The goal is to automate useful checks, prioritize real risk, and help teams ship safer software quickly.
- A laptop with Linux, macOS, or Windows + WSL2
- Git and a GitHub account
- Docker Desktop or Docker Engine
- A free GitHub Actions account for small public repositories
- Curiosity and an isolated lab — only test systems you own or are authorized to assess
- Linux filesystem, processes, permissions, users, services, and networking
- Shell scripting, environment variables, pipes, and exit codes
- Git branches, pull requests, tags, and code review
- Python basics for API calls, file processing, and automation
- HTTP, TLS, DNS, SSH, and basic troubleshooting
- Linux Journey — interactive Linux lessons
- The Linux Command Line — free book
- MIT Missing Semester — shell, editors, debugging, and tooling
- Pro Git — free official-style book
- GitHub Skills — interactive GitHub exercises
- Python for Everybody — free Python course and book
- MDN HTTP Overview — web fundamentals
Create a Python CLI that checks a web endpoint, records status and latency, handles failures, and exits with a useful status code. Add tests, a README, and a GitHub Actions workflow.
- Continuous integration versus continuous delivery and deployment
- Build artifacts, environments, approvals, rollbacks, and release strategies
- GitHub Actions workflows, jobs, runners, secrets, and permissions
- Docker images, layers, registries, volumes, and networks
- Infrastructure basics: compute, storage, networks, IAM, and observability
- GitHub Actions Documentation
- GitHub Actions Security Hardening
- Docker Get Started
- Docker Labs — hands-on examples
- DevOps the Hard Way — free practical labs
- AWS Cloud Practitioner Essentials
- Google Cloud Skills Boost — free learning activities and quotas vary
Containerize a small API and build a pipeline that runs tests, builds an image, scans it, and publishes a versioned artifact only when the checks pass.
- Threat modeling and security requirements
- Authentication, authorization, input validation, and secure error handling
- Secrets management and credential rotation
- Dependency risk, software licenses, and vulnerable packages
- SAST, DAST, SCA, IaC scanning, and security testing in pull requests
- OWASP Top 10 and common API weaknesses
- OWASP Top 10
- OWASP Application Security Verification Standard
- OWASP Threat Modeling Playbook
- OWASP Web Security Testing Guide
- PortSwigger Web Security Academy — free interactive labs
- OpenSSF Best Practices
- GitHub Dependabot Documentation
- Semgrep Academy — free secure-code lessons
| Area | Free/open-source tools |
|---|---|
| SAST | Semgrep, Bandit, CodeQL public-repository analysis |
| SCA | OWASP Dependency-Check, pip-audit, npm audit, Trivy |
| DAST | OWASP ZAP |
| Secrets | Gitleaks, TruffleHog community edition |
| IaC | Checkov, KICS, tfsec successor tools |
| Images | Trivy, Grype, Syft |
Add Semgrep, Bandit, pip-audit, Gitleaks, and OWASP ZAP to a sample application. Document false positives, severity, remediation, and the rule for when a build should fail.
- Minimal images, non-root users, immutable tags, and image provenance
- Container capabilities, namespaces, seccomp, and Linux permissions
- Kubernetes objects, namespaces, RBAC, network policies, secrets, and admission
- Pod security standards, resource limits, service accounts, and audit logs
- Runtime monitoring and safe cluster configuration
- Kubernetes Basics
- Kubernetes Security
- Kubernetes Pod Security Standards
- Kubernetes Network Policies
- Kubernetes Threat Matrix
- Dockerfile Best Practices
- CNCF Cloud Native Security Whitepaper
- KillerCoda Kubernetes Scenarios — browser-based practice
Deploy a deliberately simple service to a local cluster with kind or Minikube. Add a non-root container, read-only filesystem, resource limits, RBAC least privilege, a network policy, and an image scan.
- Terraform modules, state, variables, providers, and plan review
- Secure cloud IAM and least privilege
- Network segmentation, security groups, encryption, and logging
- Policy as code and drift detection
- Secrets in Terraform and CI/CD
- Shared-responsibility models for AWS, Azure, and Google Cloud
- Terraform Get Started
- Terraform Documentation
- Open Policy Agent
- Conftest — policy testing for configuration
- AWS Security Best Practices
- AWS Well-Architected Security Pillar
- Azure Cloud Security Benchmark
- Google Cloud Security Foundations Guide
- Cloud Security Alliance Guidance
Use Terraform to create a small cloud lab or local stack. Add Checkov or Conftest policies that reject public storage, unrestricted SSH, missing encryption, and overly broad IAM. Destroy the lab when finished.
- SBOMs, artifact signing, provenance, and reproducible builds
- Dependency pinning and trusted registries
- CI/CD runner isolation and workflow permissions
- Branch protection and protected environments
- Secure release metadata and vulnerability disclosure
- SLSA levels and the risks of compromised dependencies
- SLSA Framework
- OpenSSF Scorecard
- OpenSSF Scorecard Checks
- Sigstore — keyless signing ecosystem
- Cosign Documentation
- Syft SBOM Generator
- GUAC Supply Chain Graph
- NIST Secure Software Development Framework
- CISA Secure by Design
Build an image, generate an SPDX or CycloneDX SBOM, scan it, sign the image with Cosign in a lab, and verify the signature before deployment. Explain the trust boundaries in your README.
- Centralized logs, metrics, traces, and security alerts
- Detection engineering and useful alert thresholds
- Incident response, containment, recovery, and lessons learned
- Vulnerability management and risk-based prioritization
- Compliance evidence without turning security into paperwork
- Security metrics: mean time to detect, remediate, and recover
- AI-assisted development risks: prompt injection, secret leakage, insecure generated code, and review requirements
- NIST Cybersecurity Framework 2.0
- NIST Incident Response Recommendations
- MITRE ATT&CK
- OpenTelemetry Documentation
- OWASP Top 10 for LLM Applications
- Falco — cloud-native runtime security
- Prometheus Documentation
- Grafana Tutorials
Create an incident runbook for a compromised CI runner or leaked cloud token. Feed test logs into a dashboard, create one detection, document triage steps, and show how credentials are revoked and rotated.
- Secure CI pipeline for a containerized API
- Kubernetes hardening lab with RBAC and network policies
- Terraform security policy pack
- SBOM, image signing, and verification workflow
- Vulnerable application with documented threat model and fixes
- Security dashboard with logs, metrics, and one useful alert
- Dependency and secret scanning GitHub Action
- Incident response playbook for a supply-chain compromise
- Secure-by-default project template for new repositories
- DevSecOps maturity assessment mapped to NIST SSDF and SLSA
For every project, include architecture diagrams, threat assumptions, setup steps, test evidence, limitations, and a cleanup section.
- Monday: learn one concept and write notes
- Tuesday: reproduce it in a local lab
- Wednesday: automate one check
- Thursday: break the lab safely and investigate the alert
- Friday: document the result and improve the pipeline
- Weekend: review, read one incident report, and plan the next experiment
Spend at least half your time building. A small, documented lab is more valuable than a long list of tools you have never used.
- DevSecOps Engineer
- Application Security Engineer
- Cloud Security Engineer
- Platform Security Engineer
- Product Security Engineer
- Software Supply Chain Security Engineer
- Security Automation Engineer
Only scan, test, or deploy security tooling against systems you own or have explicit permission to assess. Use deliberately vulnerable applications and isolated labs for practice. Never commit credentials, private keys, tokens, or real customer data to a repository.
MIT — free to use, share, and modify.
Explore more beginner-friendly security and engineering projects at BlackPanda999 on GitHub.
Created by BlackPanda999 — August 2026