Cybersecurity and AI Architecture Fellow of the British Computer Society (FBCS)
2-Day Course · Intermediate · Hands-on
DevSecOps · SEC-321

DevSecOps Pipeline Security

Build a pipeline that catches vulnerabilities before they ship. This two-day course covers SAST (Semgrep, CodeQL), DAST, dependency scanning (Snyk, Trivy, Grype), container scanning, secret detection, SBOM generation, automated ASVS verification and security gate policies. You build a complete DevSecOps pipeline from scratch.

SEC-321. The syllabus

Two days, from zero to a secure pipeline

Hands-on pipeline construction. You leave with a working DevSecOps pipeline template. (Times are approximate.)

Day 1 Morning

Shifting Left and SAST

S1-00 Shifting Security Left 1 hr

Understand the economics and practicality of finding vulnerabilities earlier in the development lifecycle. Map security activities to each phase: design (threat modeling), coding (SAST, linting), build (dependency scanning), test (DAST), deploy (infrastructure scanning), and runtime (monitoring). This module sets the framework for everything that follows.

S1-01 SAST Integration: Semgrep Rules 1.5 hrs

Integrate Semgrep into your CI/CD pipeline. Write custom rules that match your application's vulnerability patterns. Cover rule syntax, metavariables, pattern operators, and autofix. Build a rule that catches your organization's most common security mistake and deploy it to the pipeline.

S1-02 SAST Integration: CodeQL Queries 1.5 hrs

CodeQL treats code as data and vulnerabilities as queries. Write CodeQL queries that trace tainted input from sources to sinks. Cover the CodeQL data model, taint tracking, and how to add custom sources and sinks for your application's frameworks.

S1-03 DAST in CI/CD 1 hr

Integrate dynamic application security testing into your pipeline. Cover OWASP ZAP automation, authenticated scanning, API scanning, and how to configure scan policies that balance coverage with pipeline speed. Handle false positives without disabling the scanner.

Day 1 Afternoon

Dependencies and Containers

S1-04 Dependency Scanning: Snyk, Trivy and Grype 1.5 hrs

Integrate dependency scanning to catch known vulnerabilities in your third-party libraries. Compare Snyk, Trivy and Grype on detection rate, false positives, and developer experience. Set up automated PR checks that block merges with high-severity vulnerabilities. Handle the operational reality of unfixable transitive dependencies.

S1-05 Container Image Scanning 1.5 hrs

Scan container images for OS-level and application-level vulnerabilities. Integrate Trivy, Grype or Snyk Container into your Docker build pipeline. Cover base image selection, multi-stage builds for minimal attack surface, and runtime scanning of deployed images.

S1-06 Secret Detection: git-secrets and TruffleHog 1 hr

Prevent secrets from reaching the repository. Deploy git-secrets as a pre-commit hook and TruffleHog as a CI scanner. Cover entropy-based detection, regex patterns for API keys and tokens, and how to handle secrets that have already been committed (rotation, not just deletion).

Day 2 Morning

Infrastructure and SBOM

S1-07 Infrastructure as Code Scanning 1.5 hrs

Scan Terraform, CloudFormation, Kubernetes manifests and Dockerfiles for security misconfigurations. Cover Checkov, tfsec, and KICS. Write custom policies for your organization's infrastructure standards. Integrate into the pipeline so misconfigurations are caught before they reach production.

S1-08 SBOM Generation and Management 1 hr

Generate Software Bills of Materials in CycloneDX and SPDX formats. Understand why SBOMs matter for vulnerability management, license compliance, and incident response. Integrate SBOM generation into your build pipeline and store SBOMs alongside artifacts.

S1-09 Automated ASVS Verification in Pipelines 1.5 hrs

Map ASVS requirements to automated checks that run in CI/CD. Cover which requirements can be verified automatically (header checks, TLS configuration, dependency versions) and which require manual review. Build a pipeline stage that runs ASVS L1 checks and reports results.

Day 2 Afternoon

Security Gates and Labs

S1-10 Security Gates and Break-Build Policies 1 hr

Define security gates that block or warn on security findings. Cover severity thresholds, exception processes, SLA-based policies, and how to avoid gate fatigue. Implement a multi-stage gate: warn on medium, block on high, and require security review for critical.

S1-11 Pipeline Hardening 1 hr

Secure the pipeline itself. Cover secret management in CI/CD (never hardcode, use native secret stores), runner isolation, artifact signing, and supply chain attacks targeting the build system. Harden GitHub Actions, GitLab CI, and Jenkins configurations.

S1-12 Capstone Lab: Build a Secure Pipeline 2 hrs

Given a repository with no security tooling, build a complete DevSecOps pipeline from scratch: SAST, dependency scanning, container scanning, secret detection, SBOM generation, and security gates. Verify the pipeline catches planted vulnerabilities and blocks the merge.

S1-13 Course Wrap-Up and Pipeline Template 0.5 hr

Review the pipeline template you take away (GitHub Actions and GitLab CI versions). Cover ongoing tuning, false positive management, and how to evolve your pipeline as your security maturity grows.

~24 hrs
Total instructional hours
20
Individual modules
2 days
Delivery days
Reserve a place

Ship code with confidence.

Two days building a DevSecOps pipeline from scratch. SAST, DAST, dependency scanning, container scanning, secret detection, SBOM and security gates. Pipeline template included.

2 days hands-on Pipeline template included Private corporate cohorts available
Reserve a Place

Corporate and sovereign cohorts, and bespoke on-site delivery, on request.