DevSecOps A Visual Guide

Are you a systems engineer, junior software engineer, platform engineer, or project newcomer who needs to understand how security fits into modern software delivery? This book is for readers who encounter terms such as CI/CD, shift left, SBOM, workload identity, policy as code, and incident response but do not yet have a connected mental model.

DevSecOps A Visual Guide teaches the essential foundation first. Rather than presenting a catalogue of tools, it explains how people, processes, source code, pipelines, artifacts, infrastructure, identities, and runtime evidence work together. Clear illustrations and diagrams make trust boundaries, delivery flows, responsibilities, decision points, and feedback loops easier to grasp quickly. Practical examples follow situations a new team member is likely to see: reviewing a repository, tracing a change to production, interpreting a scan result, handling a leaked secret, and deciding whether a release can proceed.

The book covers:

• The DevSecOps big picture, shared responsibility, and the software delivery lifecycle

• Security requirements, threat modeling, source control, and secure implementation

• Dependencies, SBOMs, provenance, signatures, and trustworthy artifacts

• CI/CD pipeline security, workload identity, secrets, and privileged access

• Infrastructure as code, policy as code, containers, and Kubernetes controls

• Security testing, risk-based release decisions, observability, and detection

• Vulnerability management, incident response, metrics, governance, and staged adoption

Frequently used intermediate practices—including OIDC federation, artifact signing, admission policy, detection as code, and risk-based security gates—are introduced only far enough to show where they fit and why they matter. This is not presented as a complete advanced reference; its strength is the focused set of concepts beginners need first.

The intended readers are systems engineers, junior software engineers, operations and platform staff, security newcomers, and team members joining a software delivery project. After finishing the book, readers should be able to trace a change from planning to production, recognize the security terminology used on the job, identify important trust boundaries and evidence, ask better risk questions, and participate more confidently in secure delivery and operations.