NOA Labs
⚙️ DevSecOps · Corporate training

DevSecOps & Secure CI/CD

Build pipelines that ship fast and safe: SAST, SCA, secrets scanning, container scanning, IaC checks, signed artifacts, SBOMs and supply-chain integrity.

Register your company → See the full outline ↓
$79 per employee · complete course
🗓️
3 weekends
Sat & Sun
⏱️
24 hours
6 live sessions
🎯
Advanced
Level
🧪
6 labs
Hands-on

Default hours 10:00 AM–2:00 PM (Asia/Karachi). Company pays — employees never pay individually.

About this training

A hands-on programme that turns a plain CI/CD pipeline into a secure software supply chain. Teams add automated security testing without slowing delivery, protect the pipeline itself from compromise, sign and verify artifacts, generate SBOMs, and measure security outcomes with meaningful metrics.

Who it's for: DevOps and platform engineers, SREs, tech leads and AppSec engineers.

What your team will be able to do

  • ✔Design a secure SDLC with security gates that developers accept
  • ✔Integrate SAST, SCA, secret, container and IaC scanning into CI
  • ✔Harden CI/CD runners, credentials and pipeline configuration
  • ✔Sign artifacts and verify provenance before deployment
  • ✔Report DevSecOps metrics leadership understands

Advanced course outline

🔒 Session notes & lab guides unlock for enrolled employees
Weekend 1
Weekend 1 · Saturday

Secure SDLC & DevSecOps culture

Shifting security left without blocking delivery.

  • ▸Secure SDLC phases and activities
  • ▸Security champions and developer enablement
  • ▸Choosing what to block vs what to report
  • ▸Managing findings and exceptions
  • ▸DevSecOps maturity models
🧪 Lab: Design a pipeline security policy 🔒 Session notes 🔒 Lab guide
Weekend 1 · Sunday

Code & dependency security in CI

SAST, SCA and secrets scanning that developers trust.

  • ▸SAST rules and tuning
  • ▸Software composition analysis and reachability
  • ▸Secret scanning and credential rotation
  • ▸Pre-commit hooks
  • ▸Triage workflows
🧪 Lab: Add code security scanning to a pipeline 🔒 Session notes 🔒 Lab guide
Weekend 2
Weekend 2 · Saturday

Container & infrastructure-as-code security

Securing what you build and where it runs.

  • ▸Minimal and distroless base images
  • ▸Image scanning with Trivy
  • ▸Dockerfile best practices
  • ▸IaC scanning for Terraform and Kubernetes manifests
  • ▸Policy as code
🧪 Lab: Harden an image and its Terraform 🔒 Session notes 🔒 Lab guide
Weekend 2 · Sunday

Securing the pipeline itself

Your CI/CD system is a high-value target.

  • ▸CI/CD threat model
  • ▸Runner isolation and ephemeral runners
  • ▸Short-lived credentials with OIDC federation
  • ▸Protecting branches and reviews
  • ▸Third-party actions and plugin risk
🧪 Lab: Remove long-lived secrets from CI 🔒 Session notes 🔒 Lab guide
Weekend 3
Weekend 3 · Saturday

Software supply-chain integrity

Proving what you ship is what you built.

  • ▸Supply-chain attacks: SolarWinds and dependency hijacking
  • ▸SBOM generation (CycloneDX, SPDX)
  • ▸Artifact signing with Sigstore Cosign
  • ▸Provenance and SLSA levels
  • ▸Admission control to enforce signatures
🧪 Lab: Sign images and verify before deploy 🔒 Session notes 🔒 Lab guide
Weekend 3 · Sunday

Runtime security, metrics & capstone

Closing the loop from production back to development.

  • ▸DAST in staging
  • ▸Runtime detection and feedback loops
  • ▸Vulnerability SLAs and ownership
  • ▸DevSecOps metrics and dashboards
  • ▸Capstone: secure pipeline review
🧪 Lab: Capstone: end-to-end secure pipeline 🔒 Session notes 🔒 Lab guide
📝
Final assessment & certificate
Multiple-choice assessment plus attendance requirement → verifiable QR certificate.

Enrol your team in DevSecOps & Secure CI/CD

One invoice for the whole team, volume discounts applied automatically.

Register your company → All corporate courses