Role track: DevSecOps Engineer

Role overview

Embed security in delivery workflows: policy gates, supply-chain controls, and feedback loops from runtime back into build and release.

Core responsibilities (framework):

  • Secure CI/CD and deployment pipelines

  • Secure infrastructure-as-code and build artifacts

  • Admission and related policy enforcement

  • Threat modeling outcomes into monitoring and IR playbooks

  • Workload isolation and zero-trust patterns in delivery

  • Artifact signing and attestation verification gates

  • Runtime detection tuning and signal quality

  • Feed production learnings back into build/test/release

Recommended sequence

Basic

  1. 101-01 — Default Secure Behavior

  2. 101-02 — Projects & Namespaces

  3. 101-03 — RBAC Basics

  4. 101-04 — SCC & Resource Guardrails

  5. 101-05 — NetworkPolicy Basics

  6. 101-06 — Secrets Management

  7. 101-07 — Image Provenance

  8. 101-08 — Etcd Encryption & Control Plane

  9. 101-09 — Audit Logging & Exec Events

  10. 101-11 — Rebuild & Harden Images

  11. 101-12 — Enforce TLS on Routes

Skip for this role: 101-10 (Platform/Architect-owned).

Intermediate

  1. 201-01 — Threat Modeling & Control Mapping

  2. 201-02 — Custom RBAC & ClusterRoles

  3. 201-03 — Custom SCC, Seccomp, SELinux

  4. 201-05 — CI/CD Scanning & Image Signing

  5. 201-06 — Secret Lifecycle Externalization

  6. 201-07 — Audit Correlation & Anomaly Detection

  7. 201-08 — Compliance Operator Tailoring

  8. 201-10 — Sandboxed Containers & Isolation

  9. 201-11 — Admission & Policy Enforcement

Advanced

  1. 301-02 — GitOps Policy & Compliance Pipelines

  2. 301-04 — Runtime Threat Detection (ACS)

  3. 301-06 — Supply Chain Integrity

  4. 301-07 — Automated Remediation

  5. 301-09 — Advanced Cryptography

  6. 301-10 — Zero-Trust Workload Identity

  7. 301-11 — Confidential Containers

Product deep-dives

Take these after Intermediate supply-chain labs (201-05 / 201-11) or alongside Advanced runtime and supply-chain labs:

  • RHACS — policy, CI/CD gates, runtime, and compliance workflows

  • TSSC — Trusted Artifact Signer and Trusted Profile Analyzer

Catalogs