Fundamentals of Moving from DevOps to DevSecOps ♾️ A Day in the life of a DevSecOps Engineer.

DevOps is more than just a set of tools; it is a culture that fosters collaboration between teams that were once siloed, such as developers, IT operations, and quality engineers. The primary goal of DevOps engineers is to deliver software that is scalable, reliable, and released quickly to end users.

• Developers👨🏻‍💻 — Write and maintain application code, implement features, fix bugs, and ensure software aligns with business and user needs.
• IT Operations👩🏻‍💻☁️ — Manage infrastructure, servers, networks, and cloud resources. They oversee deployments, monitor performance, and ensure scalability and uptime.
• Quality Engineers 🕵🏻 — Design and run tests, validate functionality, and ensure applications are reliable, secure, and meet defined requirements before release.

*💡 *Key Note: Most DevOps job roles require candidates to have skills that span all three areas — development, IT operations, and quality engineering. While depth in one specialty is valuable, breadth across these domains is essential to succeed in DevOps.

In the DevOps culture, organisations often adopt Agile methodologies as part of their software development lifecycle. Agile encourages close collaboration, continuous customer and user feedback, and adaptability to change through short, iterative release cycles. This approach ensures that software is not only delivered faster but also continuously improved. Teams collect feedback, learn from it, and make adjustments that align software with evolving customer needs.

💡 Key Note: Organizations adopt DevOps to reduce the cost and latency of development cycles and answer their customers’ demands.

CI/CD in DevOps

The work of DevOps engineers is driven by Continuous Integration (CI) and Continuous Delivery (CD).

Continuous Integration (CI) is the practice of frequently merging code changes into a shared repository, where automated builds and tests are run. This helps development teams catch bugs early in the lifecycle and fix issues before they become costly. CI ensures that code is always in a deployable state and reduces integration challenges.

Continuous Integration assumes your teams are developing on known stable versions of code.

Continuous Delivery (CD) extends CI through the automated building, testing, and preparation of code for release to one or more environments, whether staging, testing, or production. Deploying and testing across multiple environments strengthens software quality, increases confidence in releases, and reduces the risks associated with manual deployments.

The goal of CD is to safely and repeatedly deliver an artifact into a production environment.

Source: Securing DevOps by Julien Vehent

Platform engineering builds upon DevOps practices by providing standardized tools, services, and workflows that enable development teams to build software solutions more efficiently. It focuses on organizing and managing internal services and resources so that developers can deliver applications without having to handle the underlying infrastructure directly.

Platform engineers are responsible for curating, maintaining, and automating the tools, services, and documentation that development teams rely on. By doing so, they ensure that everyone in the IT organization can work efficiently without needing to be fully self-sufficient in managing operational complexities.

Securing DevOps CI/CD

For security to become an integral part of DevOps, it’s essential to first understand how applications are built, deployed, and operated within a DevOps environment.

For example, consider an e-commerce website. Developers continuously add new features such as payment options or product search filters. These updates are pushed to a shared repository (CI), such as GitHub, where they are automatically tested and then deployed to staging or production environments (CD), for instance on AWS EKS or ECS. Once the site is live, operations teams monitor its performance, scalability, and uptime.

To effectively embed security into the e-commerce application, security practices must be aligned with these workflows , integrating automated security checks, compliance validations, and continuous monitoring into every stage of the software delivery lifecycle. This ensures that security is not an afterthought but a continuous, automated process that supports agility without compromising protection.

Image of DevOps Pipeline + Security Testing Integrated by Julien Vehent

In the Continuous Integration (CI) stage, when DevOps teams push code from their local machines to a code repository such as GitHub or GitLab, the security team conducts automated security tests to identify and address potential vulnerabilities early in the development pipeline, such as static code analysis, dependency scanning, secret detection, and configuration checks.

In the Continuous Deployment (CD) stage, the code from the repository undergoes automated deployment. During this process, the security team runs security tests to ensure that the deployed application and its components meet security standards before moving to production. Security standards include vulnerability scanning, configuration validation, access control verification, and compliance checks to ensure the environment and application remain secure and aligned with organizational policies.

At the Infrastructure as a Service (IaaS) stage, the deployed application operates on public cloud platforms such as AWS, Azure, or Google Cloud Platform (GCP). During this stage, the security team conducts additional security assessments to ensure that cloud resources are properly configured and protected. These include network security evaluations, identity and access management (IAM) validation, encryption enforcement, and continuous monitoring to maintain compliance and prevent misconfigurations or unauthorized access.

DevSecOps Culture

DevSecOps is the practice of incorporating security into DevOps workflows at every stage. It emphasizes security as a shared responsibility across development, operations, and QA teams. In this approach, security checks, testing, and practices are embedded early and continuously, rather than applied only at the end.

Key principles of DevSecOps culture:

♾️ Shift Left Security: Security considerations are introduced early in the design and development process.

♾️ Automation of Security: Security testing and compliance checks are automated within the CI/CD pipelines.

♾️ Continuous Monitoring: Security vulnerabilities are continuously monitored in both development and production.

♾️ Collaboration: Security, development, and operations teams work together seamlessly, sharing accountability for secure software delivery.

Role of a DevSecOps Engineer in Threat Modeling

Threat modeling in DevSecOps involves a structured process to identify potential security threats and vulnerabilities early in the development lifecycle by analyzing the system’s design and data flow.

Before any application or system is deployed, you as the DevSecOps engineer must ensures that security is designed in from the start.

Key Responsibilities in this Process:

🔥 Understanding the Architecture:

• Review system diagrams, data flows, cloud infrastructure, network topology, and application components.
• Identify critical assets, sensitive data, and entry points for attackers.

🔥 Identifying Threats

• Use frameworks like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) to systematically assess potential threats.
• Evaluate risks from both internal and external sources.

🔥 Assessing Risk

• Determine the impact and likelihood of identified threats.
• Prioritize threats based on business criticality and potential damage.

🔥 Defining Security Controls

• Recommend security measures such as authentication mechanisms, encryption, input validation, network segmentation, and logging.
• Suggest automation for detection and response in the CI/CD pipeline.

🔥 Collaborating with Teams

• Work with developers, architects, and operations teams to ensure security measures are practical and integrated into the system design.
• Document threat models clearly so they guide implementation and ongoing monitoring.

🔥 Iterative Review

• Threat modeling isn’t one-time. DevSecOps engineers must revisit it during design changes, new deployments, or architectural updates to ensure continued protection.

Check out Threat Modeling in AWS for builders

Skills DevSecOps Engineer Uses Daily

🕵🏻 Security tools: SAST, DAST, container scanners, SIEM, IDS/IPS

🕵🏻 CI/CD tools: Jenkins, GitLab CI, GitHub Actions, CircleCI

🕵🏻 Cloud platforms: AWS, Azure, GCP security features

🕵🏻 Coding/scripting: Python, Bash, or Go for automation

🕵🏻 Collaboration & communication: Working with Dev, Ops, and QA teams

Day in the life of a DevSecOps engineer

Morning: Planning & Monitoring

• Daily Stand-up / Scrum: Participate in team meetings to discuss progress, blockers, and priorities.
• Security Alerts & Monitoring: Review dashboards for vulnerabilities, alerts from CI/CD pipelines, cloud security monitoring, or SIEM (Security Information and Event Management) tools.
• Incident Triage: If a vulnerability or security incident is detected, quickly assess its severity and impact, and coordinate mitigation steps with the relevant teams.

Midday: Development & Integration

• Collaborating with Dev and Ops Teams: Work closely with developers to review code for security issues, recommend best practices, and ensure secure coding standards are followed.
• Security Automation: Implement automated security scans, linting, and compliance checks into the CI/CD pipeline (e.g., static code analysis, dependency scanning, container scanning).
• Infrastructure as Code Security: Review Terraform, CloudFormation, or Kubernetes manifests for misconfigurations or vulnerabilities.

Afternoon: Testing & Documentation

• Penetration Testing / Vulnerability Assessment: Run manual or automated security tests on applications, APIs, or infrastructure.
• Policy & Compliance Checks: Ensure deployments meet internal policies and external regulatory requirements (e.g., GDPR, HIPAA).
• Documentation & Reporting: Document findings, write reports for stakeholders, and update security runbooks.

Evening: Continuous Improvement

• Learning & Updating Tools: Stay updated on new security threats, tools, and frameworks.
• Pipeline Optimization: Optimize CI/CD pipelines for faster and more effective security testing.
• Cross-Team Collaboration: Prepare recommendations or trainings to help teams adopt secure practices.

Stay tune on DevSecOps Projects and Resources 🚀

Let’s connect via Linkedin || Twitter || Hashnode

Reference

• Securing DevOps by Julien Vehent
• Platform engineering vs. DevOps
• Threat Modeling in AWS