Phase 01 ยท Weeks 1โ2
Foundations & DevSecOps Mindset
Understand the complete release flow before you automate
it.
Learn how development, security, release engineering, and
SRE responsibilities intersect in a modern software delivery
lifecycle. Explore the PayCore architecture, Git workflows,
pull requests, pipeline checks, security gates, canary
deployments, and the decisions that determine whether
software should ship.
Core Activities
- DevSecOps Philosophy & Shift-Left Security
- PayCore Application Architecture
- Git Branching & Pull Request Lifecycle
- Release Flow From Code to Deployment
- Security Finding Triage
- Canary Deployment Monitoring
Labs & Tools
- Git
- GitHub
- Jenkins
- PayCore
- Staging Dashboards
GitGitHubJenkinsShift-Left SecurityPayCore
Phase 02 ยท Weeks 3โ5
Cloud & Infrastructure as Code
Build infrastructure that is repeatable, auditable, and
secure.
Move infrastructure into code using Terraform and
CloudFormation. Design cloud environments with secure VPC
architecture, IAM controls, and least-privilege access while
learning secrets and configuration management with Vault
and AWS services.
Core Activities
- Terraform & CloudFormation Fundamentals
- Version-Controlled Infrastructure
- VPCs, Subnets and Security Groups
- IAM Roles and Least Privilege
- Threat Modeling and Attack-Surface Mapping
- Secrets Rotation and Configuration Management
Labs & Tools
- Terraform
- AWS
- CloudFormation
- AWS VPC
- IAM
- HashiCorp Vault
- AWS Secrets Manager
TerraformAWSCloudFormationIAMVault
Phase 03 ยท Weeks 6โ7
CI/CD Pipeline Engineering
Turn every code change into a controlled, traceable
release.
Build multi-stage CI/CD pipelines and integrate security
directly into the delivery process. Learn artifact
management, approval workflows, SAST, dependency scanning,
container scanning, and infrastructure scanning.
Core Activities
- Multi-Stage CI/CD Pipelines
- Build, Test, Package and Registry Workflows
- Artifact Traceability
- Manual Approval Gates
- SAST and SCA Integration
- Container and IaC Security Scanning
- Risk-Based Merge Decisions
Labs & Tools
- Jenkins
- GitLab CI
- Artifactory
- SonarQube
- Snyk
- Trivy
- Checkov
JenkinsGitLab CISonarQubeSnykTrivyCheckov
Phase 04 ยท Weeks 8โ9
Containers & Kubernetes
Package securely. Orchestrate confidently.
Containerize PayCore and move it into Kubernetes. Learn
secure image construction, image scanning, registry
workflows, Kubernetes architecture, RBAC, network policies,
ingress, services, and Helm-based deployment.
Core Activities
- Secure Docker Image Construction
- Image Scanning and Registry Security
- Kubernetes Pods and Deployments
- Services and Ingress
- Role-Based Access Control
- Kubernetes Network Policies
- Helm Templating and Package Management
Labs & Tools
- Docker
- Docker Hub
- Container Registry
- Kubernetes
- Helm
- kubectl
- Trivy
DockerKubernetesHelmRBACNetwork Policies
Phase 05 ยท Weeks 10โ11
Shift-Left Application Security
Find vulnerabilities before attackers โ or production โ
do.
Move application security earlier into development. Perform
static analysis, dependency scanning, vulnerability
prioritization, API protection, and runtime application
security while learning when findings should block a
release.
Core Activities
- Static Application Security Testing
- Software Composition Analysis
- CVE and CVSS Prioritization
- False-Positive Management
- Web Application Firewall Fundamentals
- API Security
- Encryption and Data Protection
- Runtime Detection and Logging
Labs & Tools
- SonarQube
- Snyk
- Safety
- ModSecurity
- OWASP
- Security Logs
SASTSCAModSecurityOWASPAPI Security
Phase 06 ยท Week 12
Cloud & Runtime Security
Protect workloads after deployment โ not just before
it.
Detect cloud misconfigurations, suspicious runtime activity,
and compliance violations across production-style
infrastructure. Learn how security continues after code
reaches production.
Core Activities
- Cloud Misconfiguration Detection
- AWS Config and Cloud Policy
- Runtime Threat Detection
- Falco Security Rules
- PCI-DSS Fundamentals
- CIS Controls
- SOC 2 Concepts
- Compliance Mapping
FalcoAWS ConfigCIS ControlsPCI-DSSSOC 2
Phase 07 ยท Week 13
Observability & Incident Response
Know what your systems are doing before users tell
you.
Build observability around PayCore using metrics, logs,
traces, dashboards, and alerts. Then apply those signals to
incident detection, triage, containment, resolution, and
postmortem workflows.
Core Activities
- Metrics, Logs and Traces
- Production Dashboards
- Alert Rule Engineering
- Request and Error-Rate Monitoring
- p99 Latency Monitoring
- Incident Triage
- Containment and Recovery
- Blameless Postmortems
Labs & Tools
- Prometheus
- Grafana
- ELK Stack
PrometheusGrafanaELKIncident ResponsePostmortems
Phase 08 ยท Week 14
AI-Augmented DevSecOps
Use AI to move faster โ without outsourcing engineering
judgment.
Apply LLMs to real DevSecOps workflows such as
troubleshooting, alert-rule generation, and security finding
analysis. More importantly, learn when AI output must be
questioned, tested, and audited.
Core Activities
- AI-Assisted Error Analysis
- Terraform Troubleshooting
- Alert-Rule Generation
- SAST Exception Drafting
- Security Finding Analysis
- AI Hallucination Detection
- Auditing AI-Generated Recommendations
ClaudeChatGPTAI Hallucination DetectionAlert Rules
Phase 09 ยท Weeks 15โ16
Governance, Policy-as-Code & Capstone
Turn everything you've learned into a production-style
release simulation.
Enforce governance with OPA and Rego before completing the
PayCore capstone. Rotate through Developer, Security
Engineer, Release Engineer, and SRE roles while handling
two different incidents under time pressure.
Core Activities
- OPA & Rego Policy Enforcement
- Shift-Left Governance
- Audit Logging
- Compliance Reporting
- Security Incident Response
- Operational Incident Response
- Rollback vs Hotfix Decisions
- Blameless Postmortem
- Architecture Defense
Labs & Tools
- OPA
- Rego
- Vault
- Full DevSecOps Toolchain
OPARegoPolicy-as-CodeCapstoneIncident Response