Application Security & DevSecOps — Skills Plan
Planned skill map for Application Security & DevSecOps. The curriculum will be developed and released in stages.
Apply threat modeling, secure coding, code and dependency scanning, CI/CD controls, SBOM practices, vulnerability triage, and remediation workflows.
Potential roles: Application Security Engineer · DevSecOps Engineer · Product Security Engineer
Before you start
- Programming and web application fundamentals
- HTTP, APIs, and database basics
- Security principles and threat modeling
What you’ll build
- Threat-model and secure a sample web service
- Create a practical security CI pipeline
- Triage, fix, and verify a vulnerability report
Prerequisites
PLANNED- Programming and web application fundamentals
Build the Programming and web application fundamentals knowledge needed to follow the Application Security & DevSecOps foundations.
- HTTP, APIs, and database basics
Build the HTTP, APIs, and database basics knowledge needed to follow the Application Security & DevSecOps foundations.
- Security principles and threat modeling
Build the Security principles and threat modeling knowledge needed to follow the Application Security & DevSecOps foundations.
Foundations
PLANNED- OWASP Top 10 and common weakness classes
Explain how OWASP Top 10 and common weakness classes works and where it fits in the Application Security & DevSecOps learning path.
- Authentication, sessions, and authorization
Explain how Authentication, sessions, and authorization works and where it fits in the Application Security & DevSecOps learning path.
- Secure coding and input validation
Explain how Secure coding and input validation works and where it fits in the Application Security & DevSecOps learning path.
- Security requirements and abuse cases
Explain how Security requirements and abuse cases works and where it fits in the Application Security & DevSecOps learning path.
Core Skills
PLANNED- Static and dynamic application security testing
Use Static and dynamic application security testing to implement a working capability and verify its behavior in Application Security & DevSecOps.
- Software composition and dependency analysis
Use Software composition and dependency analysis to implement a working capability and verify its behavior in Application Security & DevSecOps.
- Secrets detection and secure configuration
Use Secrets detection and secure configuration to implement a working capability and verify its behavior in Application Security & DevSecOps.
- API and container security testing
Use API and container security testing to implement a working capability and verify its behavior in Application Security & DevSecOps.
- Security code review and remediation
Use Security code review and remediation to implement a working capability and verify its behavior in Application Security & DevSecOps.
Advanced / Production
PLANNED- Threat modeling across product lifecycle
Evaluate Threat modeling across product lifecycle trade-offs against the performance, reliability, and safety needs of Application Security & DevSecOps systems.
- Software supply-chain security and SBOMs
Evaluate Software supply-chain security and SBOMs trade-offs against the performance, reliability, and safety needs of Application Security & DevSecOps systems.
- CI/CD security gates and risk-based exceptions
Evaluate CI/CD security gates and risk-based exceptions trade-offs against the performance, reliability, and safety needs of Application Security & DevSecOps systems.
- Cloud-native workload security
Evaluate Cloud-native workload security trade-offs against the performance, reliability, and safety needs of Application Security & DevSecOps systems.
- Vulnerability triage and coordinated disclosure
Evaluate Vulnerability triage and coordinated disclosure trade-offs against the performance, reliability, and safety needs of Application Security & DevSecOps systems.
Real-World Projects
PLANNED- Threat-model and secure a sample web service
Deliver a working outcome with Threat-model and secure a sample web service, then test it against the project requirements.
- Create a practical security CI pipeline
Deliver a working outcome with Create a practical security CI pipeline, then test it against the project requirements.
- Triage, fix, and verify a vulnerability report
Deliver a working outcome with Triage, fix, and verify a vulnerability report, then test it against the project requirements.
Career / Interview Preparation
PLANNED- Secure design review
Explain your approach to Secure design review, defend key trade-offs, and discuss what you learned.
- Vulnerability explanation and prioritization
Explain your approach to Vulnerability explanation and prioritization, defend key trade-offs, and discuss what you learned.
- AppSec program and portfolio walkthrough
Explain your approach to AppSec program and portfolio walkthrough, defend key trade-offs, and discuss what you learned.
Discussion
0Have a better approach? Found something outdated? Share it — your knowledge helps everyone learning here.