Skip to main content
IMMUNITYSEC

DevSecOps Engineer

DevSecOps engineers build security into the pipelines that take software from source code to production. NIST SP 800-204C describes DevSecOps as a culture and set of practices with automation tools that drive collaboration and shared responsibility across development, operations, and security organizations. The work centers on CI/CD pipelines with automated security testing, software supply chain controls, and security and compliance automation.

Updated

Career track
Application Security, Cloud Security

What They Do

12 tasks
  • Build CI/CD pipelines that carry out required security functions such as SBOM generation, vulnerability scanning, code signing, and audits.
  • Design, build, and maintain policy as code and the pipeline that delivers it.
  • Run static (SAST), dynamic (DAST), and software composition analysis (SCA) tools in the pipeline, against infrastructure as code as well as application code.
  • Scan commits and repositories for secrets such as passwords and keys, and use pre-commit hooks to keep secrets out of the code base.
  • Scan container images for vulnerabilities and misconfigurations before pushing them to a trusted container registry.
  • Protect all forms of code from unauthorized access and tampering, and make release integrity information, such as cryptographic hashes and code signatures, available to software acquirers.
  • Gather and investigate reports of vulnerabilities in the software and its third-party components, then plan and carry out risk responses.
  • Use threat modeling, attack modeling, or attack surface mapping to assess the security risk of the software.
  • Deploy, operate, and maintain pipeline tools and toolchains securely, since CI/CD tools add to the attack surface themselves.
  • Analyze the security and compliance impact of changes during change management, and automate security and compliance checks.
  • Require merge or pull requests with multiple approvers to reduce risks such as insider threats.
  • Set up continuous monitoring of the application's runtime state with observability as code.

Knowledge and Skills

  • CI/CD pipeline stages: building, testing, packaging, deployment, and operations
  • The five code types of cloud-native applications: application code, application services code, infrastructure as code, policy as code, and observability as code
  • Static, dynamic, and interactive application security testing (SAST, DAST, IAST) and software composition analysis (SCA)
  • Infrastructure as code scanning for misconfigurations, for example in Terraform and Helm chart code
  • Software supply chain security: SBOMs, artifact signing and provenance, and CI/CD pipeline security
  • Secrets management and secret detection in code repositories
  • Secure software development practices in the NIST Secure Software Development Framework (SSDF, SP 800-218)
  • Microservices, service mesh, and container orchestration platforms
  • Applying cybersecurity principles, standards, and automation to cloud environments and cloud system deployments
  • Threat modeling, attack modeling, and attack surface mapping

How to Become a DevSecOps Engineer

DevSecOps work combines software development, security, and IT operations. NIST SP 800-204C describes organizations forming a DevSecOps group of software developers, security specialists, and IT operations experts for each portion of an application, and calls the composition of this cross-functional team a critical success factor for introducing DevSecOps.

A 2024 U.S. General Services Administration announcement for an IT specialist (INFOSEC) with a DevSecOps engineer specialization defined the specialized experience required as applying cybersecurity IT principles, concepts, standards, automation, and industry practices to modern cloud environments and cloud system deployments. Applicants also had to pass a background investigation.

OffSec describes a path that starts with hands-on DevOps practice, including CI/CD pipelines, containers, and orchestration tools, and then adds security automation, secure coding, and security controls and testing within CI/CD pipelines. It also lists cloud security and programming or scripting in languages such as Python, Ruby, or Go, and suggests starting in either DevOps or cybersecurity roles.

The NIST Secure Software Development Framework asks organizations to provide role-based training for all personnel with responsibilities that contribute to secure development, and to review personnel proficiency periodically.

Frequently Asked Questions

What does a DevSecOps engineer do?→

A DevSecOps engineer builds security into CI/CD pipelines: automated testing with SAST, DAST, and SCA tools, secrets and container image scanning, SBOM generation, code signing, and security and compliance automation. A U.S. General Services Administration job announcement describes the priority of an embedded DevSecOps engineer as security, focusing on security design, operational security, application security, security and compliance impact analysis during change management, and security and compliance automation.

How do I become a DevSecOps engineer?→

OffSec suggests starting in either DevOps or cybersecurity roles, getting hands-on with CI/CD pipelines and containers, and then learning security automation, secure coding, cloud security, and scripting. A General Services Administration announcement for the role asked for experience applying cybersecurity principles, standards, and automation to cloud environments and cloud system deployments.

What is the difference between DevOps and DevSecOps?→

NIST SP 800-204C explains that DevOps seeks to remove the silos between development and operations groups, and that the term DevSecOps was later coined to emphasize the role of the security team in the whole process.

What tools do DevSecOps engineers use?→

The OWASP DevSecOps Guideline gives tool examples for each pipeline step, including TruffleHog for secrets in Git repositories, Semgrep and SonarQube for static analysis, Checkov for infrastructure as code, OWASP Dependency-Check for software composition analysis, Zed Attack Proxy for dynamic testing, and Trivy for containers.

Which NIST guidance covers DevSecOps?→

NIST SP 800-204C gives guidance on implementing DevSecOps, including CI/CD pipelines, for cloud-native applications built from microservices and a service mesh. NIST SP 800-218, the Secure Software Development Framework, recommends a core set of secure development practices that can be integrated into each SDLC and says it can help organizations move those practices to models such as agile and DevOps.

How do you secure a CI/CD pipeline?→

CISA and NSA published joint guidance in June 2023 with recommendations and best practices for strengthening CI/CD pipelines against malicious cyber actors, including a list of common risks and attack surfaces. The OWASP DevSecOps Guideline notes that CI/CD tools themselves often expand the attack surface, so security controls belong on build, deployment, and automation software too.

Role descriptions follow the sources listed above: U.S. government workforce data first, then standards bodies and, where named in the text, certification issuers. This site is not affiliated with CISA, the Department of Labor, or the Department of Defense.