Home›Bootcamp›DevSecOps Bootcamp

🔒 Bootcamp

DevSecOps Bootcamp

Build Security Into Your Pipeline — Not Onto It.

A practitioner-led bootcamp covering security automation across the full software delivery lifecycle — SAST, DAST, SCA, container security, IaC security, secrets management and compliance-as-code.

Duration10 Weeks

Total Hours80 Hours

LevelIntermediate

FormatOnline + Offline

CertificateYes

Enroll Now ← All Bootcamps

Delivery Format

Train How You Learn Best

💻 Online — Live Instructor-Led

Live sessions via Zoom with a ZippyOPS practitioner. 4 sessions per week, all recordings provided. Ask questions in real time and get code reviewed live.

🏢 Offline — Chennai Lab Sessions

In-person at ZippyOPS Chennai labs. Mon–Fri batches. Lab machines provided. Direct hands-on access to instructors throughout every session.

Who Should Attend

Is This Bootcamp Right for You?

✅ This bootcamp is for you if…

DevOps engineers who want to own application and infrastructure security
Security engineers learning to automate security in modern pipelines
Software developers wanting to understand and remediate security vulnerabilities
Engineers preparing for DevSecOps or cloud security roles

📋 Prerequisites

Working knowledge of CI/CD pipelines (any toolchain)
Basic Docker and container knowledge
Familiarity with cloud infrastructure (AWS, Azure or GCP)

Full Curriculum

What You'll Learn — Week by Week

DevSecOps Foundations & Threat Modelling

Week 1

▾

Shift-left security — why it matters and how to implement it without slowing delivery
OWASP Top 10 — understanding the most critical application security risks with real examples
Threat modelling — STRIDE methodology, attack trees and data flow diagrams
Security requirements in software delivery — who owns what in a DevSecOps team
Building a security champion programme across engineering teams
Lab: Threat model a real-world multi-tier web application using STRIDE

SAST — Static Application Security Testing

Week 2

▾

How SAST works — AST, CFG, taint analysis and false positive management
SonarQube — setup, quality gates, security rules and IDE integration
Semgrep — custom rules for organisation-specific security patterns
Integrating SAST into GitHub Actions, GitLab CI and Jenkins pipelines
Managing false positives — tuning rules and building an exceptions process
Lab: Configure SonarQube quality gates that block PRs with high-severity security findings

SCA — Software Composition Analysis

Week 3

▾

Understanding dependency risk — CVEs, transitive dependencies and SBOM
Dependency-Track — SBOM management, CVE tracking and policy enforcement
Snyk Open Source — developer-friendly SCA with automated fix PRs
OWASP Dependency-Check for Java and .NET projects
Licence compliance scanning and open source policy management
Lab: Build a full SCA pipeline generating SBOMs, tracking CVEs and blocking critical vulnerability builds

DAST — Dynamic Application Security Testing

Week 4

▾

How DAST works — web crawling, active scanning and authenticated testing
OWASP ZAP — baseline scan, full scan and API scanning modes
Integrating ZAP into CI/CD pipelines for automated regression security testing
Burp Suite — manual testing, intercepting proxies and extensions
API security testing — OpenAPI-driven scan automation
Lab: Configure automated OWASP ZAP scans in a CI/CD pipeline with Slack alerting on critical findings

Container & Kubernetes Security

Week 5

▾

Container image security — base image hardening and CIS benchmark controls
Trivy — comprehensive image scanning for CVEs, misconfigs and secrets
Runtime security with Falco — detecting unexpected process and file activity
Kubernetes security — Pod Security Standards, RBAC and network policies
OPA Gatekeeper — policy-as-code for Kubernetes admission control
Lab: Build a container security pipeline scanning, gating and monitoring all deployed images

IaC Security & Cloud Misconfiguration

Week 6

▾

Common IaC security mistakes — overprivileged IAM, open security groups, public S3
Checkov — scanning Terraform, CloudFormation and Kubernetes for misconfigurations
tfsec and KICS — infrastructure security linting in CI/CD
Cloud Security Posture Management — AWS Security Hub, Defender for Cloud, Wiz
Policy-as-code with OPA and AWS Config rules
Lab: Implement a policy-as-code pipeline that prevents insecure Terraform from being applied

Secrets Management

Week 7

▾

Why secrets in code is catastrophic — real breach examples and the blast radius
gitleaks and detect-secrets — scanning repos and git history for leaked credentials
HashiCorp Vault — dynamic secrets, PKI, AppRole and Kubernetes integration
AWS Secrets Manager and Azure Key Vault — cloud-native secrets management
Secret rotation automation — database credentials, API keys and certificates
Lab: Migrate a 12-factor application from hardcoded secrets to dynamic Vault-issued credentials

Compliance Automation

Week 8

▾

Compliance frameworks — SOC 2, ISO 27001, HIPAA, PCI DSS and CIS Benchmarks
ArmorPlane — automated CIS Benchmark scanning and remediation
Drata and Vanta — automated evidence collection for SOC 2
Building compliance dashboards and automated evidence pipelines
OpenSCAP — SCAP scanning for operating system compliance
Lab: Automate SOC 2 evidence collection for 8 controls using Drata and ArmorPlane

Incident Response for DevSecOps

Week 9

▾

Security incident detection — SIEM, alert correlation and triage
Container and Kubernetes incident response — forensics without downtime
Cloud incident response — isolating compromised resources and evidence preservation
Post-incident review for security events — root cause and remediation tracking
Lab: Respond to and contain a simulated supply chain attack on a containerised application

Capstone Project

Week 10

▾

End-to-end DevSecOps pipeline for a provided polyglot microservices application
SAST, DAST, SCA and container scanning — all integrated with quality gates
IaC security scanning with policy-as-code blocking insecure deployments
Vault integration for secrets management across all services
Falco runtime monitoring with PagerDuty alerting for suspicious activity
Live security review with ZippyOPS DevSecOps architects

On Completion

Earn Your ZippyOPS Certificate

🎓

ZippyOPS Certified DevSecOps Engineer (ZCDSE)

Validates practical knowledge of integrating automated security controls into CI/CD pipelines, container environments and cloud infrastructure through a full-stack security pipeline capstone.

Enroll Today

Ready to Level Up?

Seats are limited per batch. Contact us to check availability and get full pricing for the next online or offline cohort.

Enquire & Enroll ← All Bootcamps