Modern DevOps teams manage complex infrastructure and deployment pipelines that are prime targets for attackers. With security training for DevOps engineers, we help organizations integrate security throughout their operations, cloud infrastructure, and application delivery lifecycle.
Beginner to Intermediate
Five three-hour long sessions with hands-on labs
Private recordings available on YouTube
English or Ukrainian
5 000 EUR (ex. VAT) for a group of 15-25 students
DevOps, L2/L3 support engineers, and operations teams managing cloud infrastructure and CI/CD pipelines.
Private chat to interact with trainers during and after the course.
Modern DevOps teams are responsible for the entire application delivery pipeline, from infrastructure provisioning to deployment and monitoring. This makes them critical stakeholders in organizational security, yet many lack the specialized knowledge to identify and mitigate security risks in their daily operations.
Without proper security training, DevOps engineers may unknowingly introduce vulnerabilities through misconfigured cloud resources, insecure CI/CD pipelines, exposed secrets, or inadequate monitoring. This training bridges that gap by providing practical, hands-on security knowledge tailored specifically for operations teams.
This comprehensive 5-day security program progressively covers core areas of IT operations, cloud infrastructure, and application security. The focus is on making DevOps teams more security-aware and equipping them with practical tools to prevent, detect, and respond to threats throughout the software delivery lifecycle.
Introduction to fundamental security concepts, access control, password management, MFA, secrets handling, security logging and monitoring, and incident handling basics for operational teams.
Shared responsibility model, infrastructure types (IaaS, PaaS, SaaS), cloud misconfigurations, core controls including encryption, backups, IAM, network segmentation, and tools like TruffleHog for security scanning.
CI/CD security fundamentals, "shift left" principles, DevSecOps practices, supply chain security, SAST/DAST tools, dependency scanning, and infrastructure as code security with hands-on Jenkins and Docker labs.
Why and how to do threat modeling, building data flow diagrams, identifying trust boundaries, simplifying complex architectures, and hands-on threat modeling exercises using real-world case studies.
Security testing of applications, OWASP Top 10, Web Security Testing Guide, ASVS security verification standard, secure coding practices, dynamic and static testing, and hands-on vulnerability labs.
The training combines theoretical sessions with practical hands-on labs, demos, and real-world case studies. Participants practice with actual security tools and simulate real attacks to understand both defensive and offensive perspectives.
We keep DevOps teams engaged by applying hands-on training with real infrastructure and pipeline scenarios. Practical tasks keep the students excited and help them better absorb security concepts.
We share the knowledge we are practicing day-to-day in DevOps environments: no theorizing or "best practice" mumbo-jumbo, only the practical security tools and techniques.
We use real cloud environments, actual CI/CD pipelines, and genuine security tools like TruffleHog, SAST/DAST scanners in our hands-on DevOps security training.
We offer the training to DevOps, L2/L3 support, and operations teams, so there are no specific security requirements for infrastructure professionals.
In cyber security, offense and defense are both operations. Our training helps engineers understand how attackers think and how defenders respond, so they can build software that resists real-world threats. The true mastery of security lies in learning from both sides and passing that knowledge on.
Day 1
Security for DevOps Engineers
Day 2
Cloud Security and Configuration
Day 3
CI/CD & GitOps Security
Day 4
Threat Modeling
Day 5
Application Security
Our training is delivered by BSG's senior security consultants who have extensive experience in security governance, large scale environments, cloud security, and application security testing. They bring real-world expertise from hundreds of security assessments and implementations across diverse industries.
Co-founder & COO CISSP
BSG services, operations, and quality leader.
IT auditor and cybersecurity consultant.
Andriy is an accomplished manager with 10+ years of experience in various industry verticals. He has started his IT audit and consulting career and continued in enterprise IT and custom software development services.
Andriy has experience in leading customer relationships within the US, UK, and Western Europe geographies, responsible for distributed teams and permanent engagements of different scales.
Andriy has stood at the root of the Ukrainian cybersecurity professional community and has joined BSG to advance his contribution to the cybersecurity industry's development.
At BSG, Andriy acts the Chief Services Officer and a security consulting practice lead.
Security Consultant, Training Lead
OSCP, eWPTX, eMAPTPenetration tester. CTF game master. OWASP Kyiv chapter leader.
Serhii is an information security professional with vast experience in Application Security and Penetration Testing. He manages the full spectrum of appsec and pentesting engagements in the BSG portfolio.
As the BSG Training Lead, he is always up to date on the latest security trends and is passionate about organizing conferences and speaking publicly. He presented and volunteered at BruCON, OWASP Ukraine, NoNameCon, and TestingStage, among many others.
Serhii is fond of sports videogames and loves riding the drone and taking footage of his picturesque travels.
All of BSG's mid to senior-level professionals possess esteemed cybersecurity certifications, with a majority being OSCP-certified. These independent certifications validate our team's expertise in application security, penetration testing, and top-tier security consulting services.
Offensive Security Certified Professional, OSCP
(ISC)2 Certified Information Systems Security Professional, CISSP
ISACA Certified Information Systems Auditor, CISA
eLearnSecurity Web Application Penetration Tester, eWPTX
eLearnSecurity Mobile Application Penetration Tester, eMAPT
eLearnSecurity Certified Professional Penetration Tester, eCPPT
eLearnSecurity Junior Penetration Tester, eJPT
EC-Council Certified Ethical Hacker, CEH
This training is designed for DevOps engineers, L2/L3 support engineers, operations teams, and anyone responsible for managing cloud infrastructure, CI/CD pipelines, and application deployment processes. It's suitable for both technical and non-technical team members who want to improve their security awareness.
No prior security experience is required. The course starts with fundamental security concepts and progressively builds up to advanced topics. We design the training for operational teams who want to integrate security into their daily DevOps practices, regardless of their current security knowledge level.
You'll get hands-on experience with industry-standard security tools including TruffleHog for secret detection, SAST/DAST scanners for code analysis, Jenkins for secure CI/CD pipelines, Docker security practices, threat modeling tools, and comprehensive OWASP resources and testing guides.
Yes, we offer both online and on-site delivery options. Remote sessions include recorded materials, interactive labs, live demonstrations, and hands-on exercises. All participants get access to cloud-based lab environments and can interact with trainers through private chat channels during and after the course.
