DevSecOps Engineer Roadmap
From least-privilege identity and secrets management through a hardened CI/CD pipeline, container and Kubernetes security, and policy-as-code for infrastructure, the core path for shifting security left, linked into Cloud Tech by Victor topic references.
Drag to pan · Tab through steps · arrow keys jump between connected steps
Interactive diagram. Press Tab to move through the 12 steps in order; each step links to its full reference page.
Identity and access control is the foundation every other security control in the pipeline sits behind.
The baseline secure-coding defense every engineer needs before anything further up the pipeline can help.
Before adding security gates, understand the build/test/package/deploy stages a pipeline actually automates.
Centralized, short-lived secrets remove an entire class of risk that hardcoded or environment-variable credentials carry.
SAST, SCA, and DAST turn the pipeline itself into an automated gate, not just a delivery mechanism.
Container networking fundamentals are what container image and runtime security build on top of next.
Declarative, versioned infrastructure is what policy-as-code checks against next, before anything is actually provisioned.
Every image is scanned for known vulnerabilities, and built minimally, before it ever reaches a registry.
Policy-as-code evaluates a Terraform plan and can block a non-compliant change before it ever reaches apply.
Kubernetes concepts have to be solid before its security controls, RBAC, Pod Security, NetworkPolicy, make sense.
RBAC, Pod Security Standards, and NetworkPolicy are three independent mechanisms that each need to be deliberately configured, not left at their permissive defaults.
Once the pipeline, containers, cluster, and infrastructure are all hardened, logs, metrics, and traces are what let you detect the failures and attacks that still get through.