Career Roadmap
DevSecOps Engineer: Zero to Hero
This roadmap guides you from security fundamentals to professional DevSecOps engineering. You will embed security into CI/CD pipelines, harden Kubernetes clusters, secure containers, and protect the software supply chain. Security+ builds the foundation. CDP validates pipeline security. CKA and CKS validate Kubernetes operations and security. Use ExamOS practice quizzes to track progress at every stage.
Who is this roadmap for?
This roadmap is designed for DevOps Engineers who want to add security to their pipelines and infrastructure, as well as Security Engineers moving into cloud-native security who need to understand CI/CD and Kubernetes. Additionally, it is tailored for Software Engineers transitioning into DevSecOps who already write code and understand CI/CD, as well as Cloud Engineers building on AWS, Azure, or GCP who want to secure their workloads.
Skills You'll Develop
Integrate SAST, DAST, SCA, and secret scanning into GitHub Actions or GitLab CI
Build secure Docker images, scan for vulnerabilities, and implement runtime security
Harden clusters, implement RBAC, NetworkPolicies, and Pod Security Standards
Scan Terraform and CloudFormation for misconfigurations with Checkov or tfsec
Generate SBOMs, implement SLSA, sign artifacts with Cosign, and use OIDC for pipeline authentication
Enforce security policies with OPA/Gatekeeper or Kyverno in Kubernetes
Target Roles in this Roadmap
- DevSecOps Engineer: Embeds security into CI/CD pipelines and cloud-native infrastructure
- Cloud Security Engineer: Secures Kubernetes, containers, and cloud workloads
- Platform Security Engineer: Builds secure internal platforms and developer tooling
- Security Automation Engineer: Develops security tools and automates compliance
- Site Reliability Engineer (Security Focus): Implements secure, reliable systems
Typical Employer Categories
- Technology & Software Firms: Internal platform teams, product security, and cloud infrastructure
- Financial Services: Banking, fintech, trading platforms, and payment processors
- Healthcare Organizations: HIPAA-compliant pipelines, patient data protection
- E-Commerce & Retail: CI/CD security, customer data protection, PCI compliance
- Consulting & Professional Services: Security transformation and DevSecOps advisory
- Government & Defense: DoD, federal agencies, defense contractors
The Certification Path
Recommended Path
| Cert | When | Why |
|---|---|---|
| CompTIA Security+ (SY0-701) | Month 1-2 | Foundational security knowledge. Required for DoD/government roles. |
| CDP (Certified DevSecOps Professional) | Month 4-6 | Hands-on pipeline security. 12-hour practical exam. No expiration. |
| CKA (Certified Kubernetes Administrator) | Month 8-12 | Kubernetes operational depth. Required before CKS. |
| CKS (Certified Kubernetes Security Specialist) | Month 10-14 | Kubernetes security expertise. The most in-demand DevSecOps specialization in 2026. |
Specialization Path
| Cert | When | Why |
|---|---|---|
| AWS DOP-C02 | Month 14-18 | AWS DevSecOps depth. Only if your employer requires AWS-specific pipeline security. |
| Microsoft AZ-400 | Month 14-18 | Azure DevSecOps depth. Only if your employer requires Azure-specific DevOps security. |
| CISSP | Month 16-20 | Management-oriented security credential. Useful for architects and leads. |
Milestones: Junior → Mid → Senior
| Level | Milestone | When |
|---|---|---|
| Entry Level | Security+ + working CI/CD pipeline with SAST + SCA scanning | Month 4-5 |
| Practitioner Level | CDP certified + container security (Trivy) + IaC scanning integrated | Month 8-9 |
| Specialist Level | CKS certified + supply chain security + policy as code + portfolio of 3+ projects | Month 14+ |
Step 0 - Foundations (Development, Security, and DevOps)
Build the development, security, and DevOps foundation that every DevSecOps concept depends on. This is the most important step — the depth of your learning here determines everything that follows.
~3-4 months~3-4 months
Step 0 - Foundations (Development, Security, and DevOps)
Build the development, security, and DevOps foundation that every DevSecOps concept depends on. This is the most important step — the depth of your learning here determines everything that follows.
- Python scripting, Bash, Git, and Docker fundamentals
- Linux basics: file permissions, processes, reading logs, and system administration
- OWASP Top 10 and common vulnerability types (SQLi, XSS, IDOR, SSRF)
- Security fundamentals: CIA triad, authentication vs authorization, least privilege
- Cloud platform basics (choose one: AWS, Azure, or GCP)
- CI/CD pipeline fundamentals: GitHub Actions or GitLab CI
- Infrastructure as code: Terraform basics
Certifications
💡 Security+ is the most practical first credential. It establishes security vocabulary and satisfies DoD 8570/8140 requirements.
💡 OWASP Top 10 knowledge is directly tested in CDP. Know what each vulnerability is, not just its name.
💡 If you come from a security background without development experience, invest extra time here.
🏁 Entry Level Checkpoint: You have passed Security+. You can read a GitHub Actions workflow. You can write a basic Dockerfile.
🛠 Project Ideas
- ▸Write a Python script that scans a directory for hardcoded secrets using regex patterns.
- ▸Build a simple CI/CD pipeline in GitHub Actions that builds a container image and pushes it to a registry.
Step 1 - Core DevSecOps Skills (SAST, DAST, SCA, Containers, IaC)
Build the core DevSecOps engineering skills that every role requires. This covers SAST, DAST, SCA, container security, IaC scanning, and policy as code — the tools and practices that appear in every DevSecOps job description.
~3-4 months~3-4 months
Step 1 - Core DevSecOps Skills (SAST, DAST, SCA, Containers, IaC)
Build the core DevSecOps engineering skills that every role requires. This covers SAST, DAST, SCA, container security, IaC scanning, and policy as code — the tools and practices that appear in every DevSecOps job description.
- SAST (Semgrep or CodeQL): static analysis in CI/CD pipelines, rule tuning, false positive management
- SCA (Trivy or Snyk): dependency vulnerability scanning, licensing issues, update strategies
- DAST (OWASP ZAP): dynamic testing in CI/CD pipelines, authentication handling
- Secret scanning (GitHub Advanced Security or TruffleHog): detection and remediation
- Container security: Dockerfile best practices, Trivy image scanning, distroless images
- IaC security scanning (Checkov or tfsec): Terraform, CloudFormation, and Kubernetes YAML
- Policy as code (OPA/Gatekeeper or Kyverno): enforcing security policies in Kubernetes
- Pipeline gate design: when to fail a build vs warn, severity thresholds
💡 CDP is a 12-hour practical exam with a minimum passing mark of 80/100. It tests real pipeline implementation, not multiple-choice recall.
💡 The CDP has no expiration date — you are certified for life once you pass.
💡 Checkov is the most valuable IaC security tool to learn first because it supports Terraform, CloudFormation, Bicep, and Kubernetes YAML.
🏁 Practitioner Level Checkpoint 1: You have a GitHub repository with a pipeline that runs SAST, SCA, secret scanning, and DAST. You understand every tool's configuration.
🛠 Project Ideas
- ▸Build a complete CI/CD pipeline with GitHub Actions that runs SAST (Semgrep), SCA (Trivy), secret scanning, and DAST (OWASP ZAP) on every pull request.
- ▸Configure Checkov to scan a Terraform module. Set up quality gates that fail the pipeline on critical misconfigurations.
Step 2 - Kubernetes Operations and Security (CKA + CKS)
Build Kubernetes operational depth and then security expertise. Kubernetes is the dominant container orchestration platform and Kubernetes security is the most in-demand DevSecOps specialization in 2026.
~4-6 months~4-6 months
Step 2 - Kubernetes Operations and Security (CKA + CKS)
Build Kubernetes operational depth and then security expertise. Kubernetes is the dominant container orchestration platform and Kubernetes security is the most in-demand DevSecOps specialization in 2026.
- Kubernetes architecture: control plane, worker nodes, pods, deployments, services, ingresses
- Networking: Services, Ingress, NetworkPolicies, and service mesh concepts
- Storage: PersistentVolumes, PersistentVolumeClaims, and CSI drivers
- RBAC: Roles, ClusterRoles, RoleBindings, ClusterRoleBindings, and service accounts
- Cluster administration: upgrades, etcd backup and restore, troubleshooting
- Cluster hardening: CIS Kubernetes Benchmark, API server flags, and audit logging
- Pod security: Pod Security Standards, security contexts, and admission controllers
- Runtime security: Falco, audit logs, and anomaly detection
- Network security: NetworkPolicy design for zero-trust microsegmentation
- Supply chain security: image signing with Cosign, SBOM generation, and admission control
Certifications
💡 CKA must come before CKS. This is non-negotiable.
💡 CKA is a fully hands-on exam — 2 hours, 15-20 tasks in a live cluster environment, 66% passing score. $375 USD.
💡 CKS is also hands-on — 2 hours in a live cluster, 67% passing score. $375 USD.
💡 CKA and CKS together are valid for 2 years from the date of passing CKA. Plan for both within a 2-year window.
🏁 Practitioner Level Checkpoint 2: You have passed CKA and CKS. You can write a NetworkPolicy from scratch that implements zero-trust networking for a multi-tier application.
🛠 Project Ideas
- ▸Deploy a multi-tier application to Kubernetes. Write NetworkPolicies that enforce zero-trust communication between tiers.
- ▸Harden a Kubernetes cluster against the CIS Benchmark. Document each control and the remediation applied.
- ▸Implement a Falco rule that detects a privilege escalation attempt and triggers an alert.
Step 3 - Supply Chain Security and Platform Depth
Secure the software supply chain and add platform-specific depth if needed. Supply chain attacks have made this the highest-priority DevSecOps investment in 2026.
~2-3 months~2-3 months
Step 3 - Supply Chain Security and Platform Depth
Secure the software supply chain and add platform-specific depth if needed. Supply chain attacks have made this the highest-priority DevSecOps investment in 2026.
- SBOM generation: Syft, CycloneDX format, and SPDX format
- SLSA levels: achieving Level 2 and Level 3 in practice
- Sigstore ecosystem: Cosign signing, Rekor transparency log, Fulcio certificate authority
- OIDC for pipeline authentication: no long-lived credentials stored as secrets
- AWS DevSecOps depth: CodePipeline security, CodeBuild security, GuardDuty (optional)
- Azure DevSecOps depth: Azure Pipelines security, Defender for DevOps (optional)
- GitHub Advanced Security: Dependabot, CodeQL, and secret scanning at enterprise scale
Certifications
💡 OIDC-based authentication from CI/CD to cloud providers eliminates the most common supply chain attack vector — stolen long-lived credentials stored as secrets.
💡 DOP-C02 (AWS) and AZ-400 (Azure) are optional. Only pursue if your employer requires them or if you work exclusively in that platform.
💡 SLSA Level 3 is the practical target for most organizations. Level 4 is rarely achieved in practice.
🏁 Specialist Level Checkpoint: You can explain the SLSA levels. You have implemented OIDC for pipeline authentication. You have signed artifacts with Cosign.
🛠 Project Ideas
- ▸Implement OIDC authentication from GitHub Actions to AWS. Eliminate long-lived AWS credentials from your pipeline.
- ▸Generate an SBOM for a container image using Syft. Upload it to a registry and verify its contents.
- ▸Sign a container image with Cosign and verify the signature before deployment.
Step 4 - Exam Consolidation, Portfolio, and Follow-On Paths
Consolidate preparation through integrated scenario practice, timed simulations, and targeted gap closure before booking your exams. Build the portfolio that proves your DevSecOps capabilities.
~1 month~1 month
Step 4 - Exam Consolidation, Portfolio, and Follow-On Paths
Consolidate preparation through integrated scenario practice, timed simulations, and targeted gap closure before booking your exams. Build the portfolio that proves your DevSecOps capabilities.
- Full-domain scenario practice across all DevSecOps domains (pipelines, containers, Kubernetes, supply chain)
- Timed simulations for CKA and CKS (hands-on practice in a live environment)
- Portfolio projects: complete secure pipeline, hardened K8s cluster, supply chain security implementation
- Follow-on paths: Cloud Security Engineer (security focus), Platform Engineer (infrastructure focus), or AppSec Engineer (application focus)
💡 Consistent performance above 80% on Legend mode across five consecutive ExamOS sessions is the clearest readiness signal.
💡 Your portfolio matters more than any certification. Start it on Day 1 and add to it every week.
💡 CISSP is a management-oriented credential. Only pursue if you are moving toward architecture or leadership roles.
🏁 Specialist Level Checkpoint: You have passed your target certifications. You have a GitHub portfolio demonstrating each capability.
Final Step - What this path actually builds
This roadmap moves you from security fundamentals to professional DevSecOps engineering. Security+ establishes your vocabulary. CDP proves you can secure CI/CD pipelines hands-on. CKA validates Kubernetes operational depth. CKS validates that you can secure Kubernetes at enterprise scale. The DevSecOps engineer who completes this path holds credentials and a portfolio — the combination hiring managers consistently describe as the profile they cannot find enough of. DevSecOps is the bridge between developers, operations, and security. The ones who succeed are those who can write a pipeline, understand a CVE, explain the business risk, and present the remediation path to a developer. Build real pipelines. Harden real clusters. Measure your readiness with ExamOS. Book when your reasoning is sharp and your portfolio is complete.
Final Step - What this path actually builds
This roadmap moves you from security fundamentals to professional DevSecOps engineering. Security+ establishes your vocabulary. CDP proves you can secure CI/CD pipelines hands-on. CKA validates Kubernetes operational depth. CKS validates that you can secure Kubernetes at enterprise scale. The DevSecOps engineer who completes this path holds credentials and a portfolio — the combination hiring managers consistently describe as the profile they cannot find enough of. DevSecOps is the bridge between developers, operations, and security. The ones who succeed are those who can write a pipeline, understand a CVE, explain the business risk, and present the remediation path to a developer. Build real pipelines. Harden real clusters. Measure your readiness with ExamOS. Book when your reasoning is sharp and your portfolio is complete.
Certifications
Final Thoughts
💡 Total: 10-16 months at 2 hours/day (8-12 months at 3-4 hours/day)
💡 Security+: Typically takes 4-6 weeks for candidates with basic IT experience.
💡 CDP: Requires 4-6 weeks of dedicated hands-on pipeline building. 12-hour practical exam.
💡 CKA + CKS: Allocate 4-6 months minimum for both. CKA must come first.
💡 Readiness: Consistent 80%+ on Legend mode across five sessions is your signal to book.
Honest Timeline
| Path | Minimum Study Pace | More Realistic Pace |
|---|---|---|
| Security+ only | ~1 month | ~2 months |
| Security+ + CDP | ~4 months | ~6 months |
| Security+ + CDP + CKA + CKS | ~8 months | ~14 months |
| Security+ + CDP + CKA + CKS + DOP-C02/AZ-400 | ~10 months | ~16 months |