For a while my setup looked like this: DevOps tutorials on one screen, cybersecurity labs on the other, and my brain asking what exactly we were doing.
It took me some time to see that it wasn’t two different paths. It was one: DevSecOps.
DevOps + Security
DevOps is about building systems that are fast and automated: CI/CD, infrastructure as code, containers, monitoring. DevSecOps keeps all of that and adds one rule: security is part of every step, from the first commit to production.
No more “we’ll fix security later.” It’s “security is part of everything.”
In practice that means things like scanning dependencies in the pipeline, not running containers as root, keeping secrets out of Git, giving every service only the permissions it needs, and watching what actually happens on the network.
What I’m doing about it
- Following the Cloud DevOps track at Zone01 Oujda: containers, orchestration, infrastructure as code.
- Studying cybersecurity in parallel.
- Preparing for the CKA, because Kubernetes is where a lot of security decisions end up.
- Building projects like deep-in-net, where I look at how systems talk inside a network and where the risks are.
Why write about it
This blog is my notebook. Every time something clicks, or breaks, I’ll write it down here. If you’re on the same path, or already working in DevSecOps, I’d love to hear from you on LinkedIn.