March 29, 2024
Updated October 22, 2025
19 minute read
DevSecOps Engineer: A Comprehensive Career Guide
n1bzyy|
Find a path to becoming a DevSecOps Engineer. Learn more at:
OpenCourser.com/career/n1bzyy/devsecops
Featured in The Course Notes
This career is mentioned in our blog,
The Course Notes. Read
two articles that feature
DevSecOps Engineer:
To read more articles from OpenCourser, visit:
OpenCourser.com/notes
Reading list
We've selected some books
that we think will supplement your
learning. Use these to
develop background knowledge, enrich your coursework, and gain a
deeper understanding of the topics covered in
DevSecOps Engineer.
CNCF Technical Oversight Committee chair Liz Rice wrote the definitive guide to how containers actually work and fail at the Linux kernel level. Readers build a container from scratch in Go to see firsthand how cgroups, namespaces, capabilities, seccomp, AppArmor, and rootless isolation prevent container escapes.
Authored by Jez Humble and David Farley, this foundational classic defines the deployment pipeline, automated testing, and zero-downtime release practices that underpin modern CI/CD.
Illustrated and accessible, this Manning guide walks software engineers through designing fast, deterministic build-and-test pipelines, eradicating flaky tests, and structuring greenfield and legacy workflows.
ControlPlane founder Andrew Martin and Michael Hausenblas apply red-team threat modeling to containerized clusters, dissecting real-world container breakouts, kubelet exploitation, etcd secret theft, RBAC privilege escalation, and CNI network lateral movement alongside concrete hardening controls.
Creane and Gupta demonstrate how eBPF-powered runtime observability and zero-trust network policies protect containerized workloads in production. Practical chapters cover image supply-chain scanning, admission controllers, mutual TLS service meshes, and runtime intrusion detection.
Connecting technical CI/CD practices—automated testing, feature flags, dark launches, and telemetry—to value-stream flow shows how elite engineering teams deploy safely multiple times per day.
Empirical DORA research across thousands of organizations proves that deployment frequency, lead time for changes, change failure rate, and mean time to recovery are directly driven by CI/CD capabilities.
Written by experts in the field, this book offers a comprehensive overview of cloud security, including cloud security architecture, governance, risk management, and compliance.
Demonstrates how to build end-to-end automated pipelines using Docker containers and Jenkins, covering continuous integration, acceptance testing, and production deployment strategies.
Provides a comprehensive overview of cloud computing security, covering topics such as cloud security architecture, threats to cloud computing, and cloud security best practices.
Modern container runtime security tools—such as Cilium Tetragon, Falco, and Tracee—rely on eBPF to inspect system calls and block malicious container behavior directly inside the Linux kernel. Liz Rice teaches engineers how eBPF LSM hooks enforce container security policies with near-zero overhead.
An official guide on Argo CD that covers the basics of the topic, including installation, configuration, and usage. It good starting point for beginners.
Comprehensive O'Reilly guide covering event-driven workflow YAML syntax, custom composite and JavaScript actions, matrix builds, OIDC cloud authentication, and self-hosted runners.
Huang and Jumde provide a thorough operational blueprint for hardening Kubernetes clusters, covering pod security contexts, network policies, RBAC, secrets management, and runtime threat mitigation across cloud-native deployments.
Walks engineering teams through building secure, maintainable CI/CD workflows on GitHub Actions, from reusable composite actions and matrix builds to OIDC cloud deployments.
Combining push-based CI container builds with pull-based CD reconciliation using Argo CD and Flux represents the modern standard for cloud-native continuous delivery.
Shah examines the full lifecycle of securing containerized cloud-native software, from base image provenance and SBOM generation to admission controllers, service mesh mTLS, and continuous runtime posture monitoring.
Provides a deep dive into cloud security controls, covering topics such as access control, data protection, and security monitoring.
A comprehensive guide to continuous delivery on Kubernetes. It covers topics such as Argo CD, Jenkins, and Helm.
Establishes the core principles of continuous integration, showing how frequent commits, automated builds, and fast feedback loops prevent integration debt and improve software quality.
Estrin addresses modern container and cloud-native security architecture in this 2024 guide, detailing zero-trust workload identity, supply chain integrity, secrets rotation, and defense-in-depth across orchestrated clusters.
Guides engineering leaders and platform teams through designing cloud-native continuous delivery architectures, aligning release governance, observability, and deployment velocity at scale.
Mouat explains Linux container internals—namespaces, cgroups, capabilities, and union filesystems—while demonstrating how to build, ship, and lock down Docker images safely in production environments.
Hands-on engineering walkthrough teaching how to architect scalable Jenkinsfiles, dynamic container build agents, static security scans, and automated cloud deployments.
Provides a guide to protecting data and applications in the cloud, covering topics such as cloud security architecture, cloud security best practices, and cloud security tools.
Container security begins long before a pod starts running: poisoned base images, typosquatted packages, and compromised CI runners require Software Bills of Materials (SBOMs), SLSA provenance attestations, and Sigstore Cosign verification.
A comprehensive guide to Kubernetes that includes a chapter on Argo CD. It provides a good overview of the topic and how Argo CD fits into the Kubernetes ecosystem.
A book that provides a comprehensive guide to building and operating Kubernetes operators. It includes a chapter on Argo CD and how it can be used to implement continuous delivery.
A book that provides a comprehensive guide to building and operating secure and reliable Kubernetes applications. It includes a chapter on Argo CD and how it can be used to implement continuous delivery.
A book that provides a collection of patterns for building and operating Kubernetes applications. It includes a chapter on Argo CD and how it can be used to implement continuous delivery.
A comprehensive guide to Kubernetes that includes a chapter on Argo CD. It provides a good overview of the topic and how Argo CD fits into the Kubernetes ecosystem.
Provides an enterprise perspective on cloud security and privacy, covering topics such as cloud security risk management, cloud security compliance, and cloud security best practices.
Provides a practical guide to cloud security for architects, developers, and business leaders, covering topics such as cloud security architecture, cloud security best practices, and cloud security tools.
Fast feedback loops, small batch sizes, modularity, and separation of concerns explain why Continuous Delivery is not merely an ops script, but a holistic software engineering discipline.
Luksa builds deep mental models of Kubernetes primitives—pods, deployments, services, RBAC, and resource quotas—giving security engineers the architectural fluency required to audit and harden cluster workloads.
Goasguen and Hausenblas provide concise, task-oriented recipes for configuring Kubernetes RBAC roles, ServiceAccounts, Secrets, NetworkPolicies, and security contexts for containerized workloads.
Mack lays out pragmatic DevSecOps workflows for embedding automated container scanning, infrastructure-as-code policy checks, and continuous compliance gates directly into CI/CD delivery pipelines.
Binnie and McCune walk platform security engineers through hardening the container host OS, isolating multi-tenant pods with gVisor and Kata Containers, writing Open Policy Agent (OPA) Gatekeeper Rego policies, and detecting anomalous syscalls with CNCF Falco.
Provides a strategic perspective on CSPM, focusing on how to align it with overall security goals and objectives.
Translating Eliyahu Goldratt's Theory of Constraints from factory floors to IT release management vividly illustrates how manual deployment bottlenecks strangle business survival.
Denniss walks developers through designing, deploying, and securing containerized applications on Kubernetes, emphasizing least-privilege service accounts, network isolation, and production-ready configuration hygiene.
Distilling a decade of consulting experience since his original classic, Farley provides a step-by-step blueprint for commit stages, acceptance test environments, and release readiness.
Software containers borrowed their entire metaphor—standardized, intermodal, sealed units with uniform handling interfaces—directly from Malcom McLean's 1956 steel shipping container. Levinson shows how standardization revolutionized global logistics while creating new inspection and security challenges.
Explores advanced GitHub Actions automation, self-hosted runners, custom Docker and JavaScript actions, and enterprise governance for scaling continuous delivery across repositories.
Maintainer of the Linux man-pages project Michael Kerrisk provides the definitive reference on process credentials, capabilities, chroot jails, file permissions, and system calls. Deeply understanding Linux user-space/kernel-space boundaries is the ultimate superpower for container security researchers.
Provides actionable recipes for implementing GitOps-driven continuous delivery on Kubernetes with Argo CD and Flux, ensuring declarative, auditable production deployments.
Provides a technical perspective on cloud security posture management, covering topics such as security assessment, risk management, and compliance.
For more information about how these books relate to this course, visit:
OpenCourser.com/career/n1bzyy/devsecops
Save
