DevSecOps Fundamentals

What this cybersecurity course is

DevSecOps Fundamentals is a 6-module cybersecurity course for software engineers, platform engineers, and security practitioners moving into the seam between development and security. Every module is grounded in primary-source frameworks: NIST SP 800-218 (Secure Software Development Framework), the OWASP Top 10 (2021) and OWASP Application Security Verification Standard v4, the Supply chain Levels for Software Artifacts (SLSA) framework, the Accelerate research program (Forsgren, Humble, Kim 2018) on continuous-delivery performance, and the CIS Controls v8. The course covers the full DevSecOps stack: how to shift security left into design and CI, what static and dynamic application-security testing tools actually catch and miss, how to harden a CI/CD pipeline against attacker tampering, and how to ship a software bill of materials (SBOM) that survives a supply-chain audit. Designed by Julian Calvo, Ed.D. in Applied Learning Sciences (University of Miami, 2026).

The course sequences six modules around the secure-software lifecycle: design, code, build, test, release, and operate. Each module pairs a primary-source standard with a hands-on artifact: read the standard, apply it to a real CI pipeline, document the security review the way a platform-engineering team would expect to see it. The pedagogical pattern follows Kolb's experiential learning cycle (1984) and the Dreyfus skill acquisition model (1980): concrete pipeline configurations, structured reflection against the standard, abstract conceptualization through the controls catalog, then active experimentation in a free-tier sandbox. Every claim is cited to NIST, OWASP, SLSA, the Accelerate research program, BLS, ISC2, or peer-reviewed research. No vendor application-security-platform marketing.

Six modules

1. Module 01 · 130 minShift-Left and the Secure Software Development Framework+

   What 'shift-left' actually means as an operational practice, why NIST SP 800-218 codifies it as the SSDF, and how to read the framework as a working tool for a platform-engineering team rather than a marketing slogan.

   Learning objectives

   • Cite the four practice groups of NIST SP 800-218 (Prepare the Organization, Protect the Software, Produce Well-Secured Software, Respond to Vulnerabilities) and identify a concrete platform-team activity for each
   • Explain why the Accelerate research (Forsgren, Humble, Kim 2018) found that high-performing engineering organizations have lower change-failure rates than low-performing ones, even though they ship more frequently
   • Distinguish 'shift-left security' as a slogan from shift-left as a measurable practice (where security review moves earlier in the lifecycle and produces evidence of effort)
2. Module 02 · 140 minOWASP Top 10 and ASVS+
3. Module 03 · 140 minSoftware Supply Chain Integrity and SLSA+
4. Module 04 · 120 minCI/CD Pipeline Hardening and Secret Management+
5. Module 05 · 110 minRuntime Security and Detection for DevSecOps+
6. Module 06 · 100 minThe DevSecOps Career Trajectory+

Target audience

• Software engineers stepping sideways into security-focused or platform-engineering roles
• DevOps engineers taking on the security portion of a platform-team charter
• Application security engineers who want to ground their work in primary-source frameworks instead of tool-vendor marketing
• Security engineers from on-prem or SOC backgrounds entering modern CI/CD environments
• Engineering managers building or scaling a DevSecOps program

Prerequisites

• Working comfort with Git, a CI system (GitHub Actions, GitLab CI, CircleCI, Jenkins), and at least one programming language
• Basic understanding of TLS, OAuth, and at-rest encryption
• Familiarity with at least one container runtime (Docker, containerd) and one orchestrator (Kubernetes, ECS, Cloud Run)
• Willingness to commit 8 to 10 weeks of 4 to 6 hours per week study

Related cybersecurity content

• DevSecOps Engineer cybersecurity career guide
• DevSecOps Engineer salary data
• Application Security Engineer career guide
• Cloud Security Fundamentals (the cybersecurity cloud-platform companion)

Disclaimer

This course is for educational purposes only. It does not guarantee employment, certification pass rates, or shipped-product security outcomes. Software security is contextual; recommendations in this course must be adapted to the specific stack, threat model, and risk tolerance of the consuming organization. NIST and US Government materials cited here are public works. OWASP materials are licensed under Creative Commons Attribution-ShareAlike. SLSA is a Linux Foundation project. DecipherU is not affiliated with any standards body or platform vendor.