DevSecOps gets tossed around as punchlines at DEF CON, BlackHat and the likes of other security conferences. You are just a baby face at confluence of the best of the best cybersecurity professionals, until you utter the word DevSecOps to the question, “So what do you do exactly at your company?”

Okay! I already answered your question, you can stop reading now.

If you are still here, then let me tell you that DevSecOps is when you integrate security into every step of the software development lifecycle aka SDLC. You fix bugs - yes. But it’s more about building secure software from design to deployment. 

‍

Table of Contents

1. Why DevSecOps Is On The Rise
2. Why DevSecOps Is A Good Career Choice 
3. Your Path in Becoming a DevSecOps Engineer (or not)
4. A Competitive Edge

‍

Why DevSecOps Is On The Rise

Cybercrime isn't taking a break. In fact, according to Forbes, the worldwide cost of cybercrime could reach a whopping $10.5 trillion annually by 2025. That's a lot of zeros! It’s scary to think that companies aren’t doing their due diligence to protect their digital assets. 

Now more than ever, we need experts who understand security principles and best practices, to streamline development and operations with security as the top priority. The demand for DevDecOps has been on the rise for this exact reason. Hiring someone who has coding skills is easy. I bet you can! I bet you can also be the reason your company will suffer another devastating data breach! 

‍

Why DevSecOps Is A Good Career Choice 

There's a reason why the DevSecOps market is expected to reach $23.42 billion by 2028, growing at a breakneck pace of 32.2%. Companies are realizing that integrating security into their DevOps pipelines is no longer optional.

Choose DevSecOps because…

• High demand, low supply - Cybersecurity Ventures reports that 76% of cybersecurity leaders struggle to find skilled professionals. That means excellent job security and competitive salaries for those with the right skillset (you??)
• Learn, learn, learn - Cybercriminals are as innovative as they come — they deceive, they hack, they breach. That’s why DevSecOp Engineers are constantly learning new technologies and techniques to keep their skills sharp and their minds engaged. 
• Work that matters - Building secure and resilient software means you are protecting your company’s reputation, and keeping your customers’ trust. It’s not as simple as logging in at 9, and logging out at 5. 
• Collaboration and communication - DevSecOps is all about breaking down silos between development and security teams. You’ll be working with diverse groups of people, and this can be a great way to improve your communication and interpersonal skills. 
• No two days are the same - Automating security testing. Implementing security controls. Collaborating with developers to fix vulnerabilities. Told ya! No two days are the same.

‍

So, Is DevSecOps a Good Career Option?

Absolutely! If you're passionate about technology, enjoy problem-solving, and want a career that's both challenging and rewarding, then DevSecOps might be the perfect fit for you. 

‍

‍

Your Path in Becoming a DevSecOps Engineer (or not)

Two words: CONTINUOUS LEARNING. That’s it. 

‍

Build a Solid Foundation

• DevOps Fundamentals. Start with the core principles of DevOps, such as understanding concepts like CI/CD, automation, and infrastructure as code. Resources like the DevOps Handbook can be invaluable.
• Cloud Technologies. Familiarize yourself with at least the top 3 cloud service providers: AWS, Azure, or GCP. Courses such as Introduction to Azure and Introduction to AWS S3 can jumpstart your cloud journey.
• Programming Languages: Strengthen your coding skills in languages commonly used in DevSecOps, such as Python, Java, or Go. The Python Security Playground and Java Security Playground offer hands-on coding practice with a security focus. 

‍

Mastering Security Essentials:

• Application Security Fundamentals: Dive deeper into application security concepts, exploring vulnerabilities like SQL injection, XSS, and insecure deserialization. Courses such as "Injections, XXE, and Insecure Deserialization" and Cross-Site-Scripting Attack and Defense provide a solid grounding.
• Security Testing: Gain hands-on experience with security testing tools and techniques, including SAST, DAST, and SCA. The DAST Automation with OWASP ZAP and Static Analysis and Code Review for DevSecOps courses offer practical training in these areas.
• Cloud Security: Understand the unique security challenges and solutions in cloud environments. Courses like Attacking and Securing GCP Compute Infrastructure and Essential AWS Security Monitoring equip you with cloud-specific security knowledge. 

‍

DevSecOps Best Practices

• DevSecOps with Jenkins: Learn to use Jenkins, a popular automation server, for building and automating your DevSecOps pipeline.  SAST with Jenkins and DAST with Jenkins can guide you through integrating security testing into your CI/CD workflows.
• Secrets Management: Explore tools like Hashicorp Vault to securely manage secrets and protect sensitive data. The Secrets Management with Hashicorp Vault course provides hands-on experience in this critical area.
• Container Security: Dive into the world of container security, learning how to secure containerized applications and deployments. The Attacking and Defending Containers and Essentials of Container Monitoring courses provide comprehensive coverage.
• Kubernetes Security: Understand the security intricacies of Kubernetes, a popular container orchestration platform. Courses such as Kubernetes 101 and Kubernetes Authentication and Authorization will equip you with the necessary skills.

‍

Expanding Your Horizons

• Threat Modeling: Learn how to proactively identify and mitigate security risks through threat modeling.  Threat Modelling Essentials and Agile Threat Modelling provide valuable insights and practical techniques.
• API Security: Understand the unique security challenges of APIs and how to secure them effectively.  API Security: Attack and Defense offers a comprehensive exploration of API security vulnerabilities and defense strategies.

‍

It Never Ends

• Stay updated with the latest trends and technologies through industry publications, conferences, and online communities.
• Explore specialized areas within DevSecOps, such as cloud security, application security, or DevSecOps automation.

‍

A Competitive Edge

James Scott, a prominent veteran in the cybersecurity space once said, "There’s no silver bullet with cybersecurity; a layered defense is the only viable option". It's not career altering to transition from being a DevOps to DevSecOps, rather it's a slow-churned process; with every skill that's learnt-practiced, you are layering your DevOps mindset, with security-first approach, inching closer to being a DevSecOps professional!

‍