Let’s make it work for you
- Categories:
- Cyber Security Agile and Lean
- Level:
- Fundamentals
- Tier type:
- PremiumPlus
- Code:
- QADEVSECOPS
- Exam:
- Not Applicable
Overview
This practical course builds expertise in enterprise-scale AI-powered DevSecOps practices for modern software delivery environments. Delegates will learn to build secure DevSecOps pipelines with AI integrated from the start, using the Model Context Protocol (MCP) to enrich findings and streamline triage. The course covers supply chain security, automation, and the most effective tools used in production, helping learners overcome common DevSecOps challenges and scale security across enterprise environments. Hands-on labs and guidance from experienced security professionals ensure practical skills and real-world application.
Prerequisites
Anybody with a background in IT or related to software development whether a developer or a manager can attend this course to get an insight about DevOps and DevSecOps.
Target audience
- DevOps and DevSecOps engineers
- Application security engineers
- Developers and technical leads
- Enterprise and solution architects
- Operations teams
- CISOs
What's included
Select your preferred way to learn:
What is Virtual?
Live, instructor-led training delivered online
Enables teams or individuals to learn together without travel, maintaining interaction, discussion and practical exercises while minimising time away from the business and supporting scalable training delivery.
Who is it for: Individuals and teams needing flexible, instructor-led learning without time away from the business.
Do you know about our Attend from Anywhere (AFA) option?
Join in person or remotely, with the same live instruction, interaction and hands-on experience—wherever you are.
What's included?
2 Days instructor led course
Exam: Not Applicable
6 month free access to QA learning platform
Free 6-Month Access: Learning Platform Discovery plan
Included FREE with every instructor‑led course
Get free guided access to the QA Learning Platform. Assess your skills, explore in-demand topics, and understand which areas to focus on.
Learn AI, Cloud, Data, and Leadership skills at your own pace.
Put skills into practice with hands-on Labs and Simulabs.
Validate knowledge and highlight gaps with skills assessments.
What is bespoke training?
Custom instructor-led training designed by QA to fit your needs
Tailored programmes built around your organisation’s goals, challenges, and skill levels. Delivered in the format that suits you to maximise relevance and impact.
Best for: Organisations and teams looking to target specific business priorities and capabilities with QA subject matter expertise.
Find out more about the course:
Dates
No dates available?
Can't find a date that fits? Need to train your whole team, explore classroom options, or looking for a discount?
Outline
Lab setup
- Introduction to online lab setup and GitHub CI/CD
Introduction to DevOps
- Overview of industry standards and practices
- Continuous Integration (CI)
- Continuous Delivery (CD)
- Infrastructure as Code (IaC)
- Continuous Monitoring
Introduction to DevSecOps
- Integrating security into the software development lifecycle
- Shift Left
- DevSecOps lifecycle
- Vulnerability management
Role of version control
- Git as central version control
- GitHub platform and actions ecosystem
- Pull requests and merge requests
Supply chain security
- Ensuring trusted and verified components
- Creating security artifacts like provenance
- Pushing results into ASPM
- SLSA levels and AIBOM
Continuous integration
- Identifying and remediating issues early
- Pre-commit hooks and frameworks
- Secrets management and credential handling
- Tools: GitHub actions, GitHub Secrets, Talisman, Trufflehog, Defect Dojo
Software composition analysis (SCA)
- Conducting SCA scans locally and in pipelines
- Integrating with ASPM
- Remediation strategies
- Tools: Dependency-check
Enabling AI using MCP
- Fundamentals of Model Context Protocol (MCP)
- Building and deploying MCP server
- Reducing token costs
- Tools: MCP Server, MCP Client, GitHub Actions
SAST
- Running and integrating SAST scans
- Customising SAST rules
- False positive analysis in ASPM
- AI enrichment of findings
- Tools: Opengrepo MCP Tool
AI Pen-testing and DAST
- Configuring DAST for continuous testing
- AI-driven Pen testing agents
- Using OWASP ZAP and AI-assisted tools
- Tools: AI Pentest tool, MCP Tool, OWASP ZAP
Continuous deployment
- Embedding security controls in deployment pipelines
- Using SBOM as a deployment gate
- Fixing flagged components and dependency issues
- Assessing infrastructure security
- Tools: CycloneDX, Docker, MCP Tool
Continuous monitoring
- Logging and monitoring applications and infrastructure
- Setting up logging and monitoring
- Firewalls and SIEM
- Custom firewall rules
- Tools: ModSecurity, Wazuh
DevSecOps challenges and enablers
- Overcoming organisational and cultural challenges
- Creating security champions
- Case study discussions
Exams and assessments
Certificate of completion and Continuing Professional Education (CPE) credits awarded. Learning pack provided. Missing information provided for this section.
Hands-on learning
- Running tools and testing against realistic use cases in dedicated labs
- Automating code reviews for vulnerability and supply chain security
- Implementing Defence in Depth and Secure by Design environments
- Embedding human and cultural aspects of DevSecOps
- Connecting MCP server to pipelines and using AI agents for enrichment, triage, and remediation
Learning outcomes
This course uses a Defence by Offense methodology based on real-world offensive research (not theory). That means everything we teach has been tried and tested, either in a live environment or in our labs, and can be applied (by you) once the course is over.
Delegates will learn how to:
- Focus on supply chain security to harden CI/CD pipelines.
- Exactly where to start when shifting from DevOps to DevSecOps.
- Understand the role of Asset registry, security onboarding, vulnerability management, and supply chain security.
- See how AI agents, connected via the Model Context Protocol (MCP), enrich and triage findings directly inside your DevSecOps pipeline.
- Learn how to automate security into a fast-paced DevOps environment using various open-source tools and scripts that don’t slow down delivery.
- Master the ability to craft custom rules for SAST, WAF, and Compliance as Code (CaC) to strengthen application security, enforce policies at scale, and proactively defend against evolving threats.
- Hands-on experience in managing Application Security Posture Management(ASPM) systems and remediating issues to reduce the attack surface.
- How to secure the pipeline from supply chain attacks using provenance and SBOM.
- How to secure your methodology for managing and delivering Infrastructure as Code (IaC).
- How to use Wazuh to monitor your application’s behaviours with logs and alerts.
- How AI-assisted pentesting complements traditional DAST scanning.
- What challenges to expect when moving to a DevSecOps model and how to overcome them.
- How to mature your DevSecOps approach over time.
Good to know
QA is proud to be an official partner with NotSoSecure.
NSS Technical Paper - Defending against Client-Side Attacks
Why choose QA
- Award-winning training, top NPS scores
- Nearly 300,000 learners in 2020
- Our training experts are industry leaders
- Read more about QA
Cyber Security learning paths
Want to boost your career in cyber security? Click on the roles below to see QA's learning pathways, specially designed to give you the skills to succeed.
Software learning paths
Want to boost your career in software engineering? Click on the roles below to see QA's learning pathways, specially designed to give you the skills to succeed.
Secure Engineering learning paths
Want to boost your career in Secure Engineering? View QA's learning pathway below, specially designed to give you the skills to succeed.
Related courses
Get in touch for pricing, team bookings and exclusive discounts
Ready to book? Complete the form and a member of our team will be in touch shortly to discuss your options.
Let’s make it work for you. Speak to one of our learning experts today.
What our customers are saying
“I would say the secure software engineering programme QA built, is beyond training. It is more around making transformation in the mindset of people, and this was exactly what we are looking for.”
Emil Minev
Senior Consultant & Programme Manager, Paysafe Group
“I really enjoyed the practical experience given by the labs, and also being able to make use of the expertise of the trainers and learn tips and tricks from them. Overall, it was an excellent overview of the cyber security profession as a whole. The learning experience was fun and exciting!”
QA learner
“I loved learning about Open Source Intelligence - the things you can do just with Google are amazing! Also, being able to meet, work with, and chat to other people interested in cyber was fantastic.”
QA learner
Portfolio Director
Richard Beck
Portfolio Director – Cyber
Frequently asked questions
How can I create an account on myQA.com?
There are a number of ways to create an account. If you are a self-funder, simply select the "Create account" option on the login page.
If you have been booked onto a course by your company, you will receive a confirmation email. From this email, select "Sign into myQA" and you will be taken to the "Create account" page. Complete all of the details and select "Create account".
If you have the booking number you can also go here and select the "I have a booking number" option. Enter the booking reference and your surname. If the details match, you will be taken to the "Create account" page from where you can enter your details and confirm your account.
Find more answers to frequently asked questions in our FAQs: Bookings & Cancellations page.
How do QA’s virtual classroom courses work?
Our virtual classroom courses allow you to access award-winning classroom training, without leaving your home or office. Our learning professionals are specially trained on how to interact with remote attendees and our remote labs ensure all participants can take part in hands-on exercises wherever they are.
We use the WebEx video conferencing platform by Cisco. Before you book, check that you meet the WebEx system requirements and run a test meeting to ensure the software is compatible with your firewall settings. If it doesn’t work, try adjusting your settings or contact your IT department about permitting the website.
How do QA’s online courses work?
QA online courses, also commonly known as distance learning courses or elearning courses, take the form of interactive software designed for individual learning, but you will also have access to full support from our subject-matter experts for the duration of your course. When you book a QA online learning course you will receive immediate access to it through our e-learning platform and you can start to learn straight away, from any compatible device. Access to the online learning platform is valid for one year from the booking date.
All courses are built around case studies and presented in an engaging format, which includes storytelling elements, video, audio and humour. Every case study is supported by sample documents and a collection of Knowledge Nuggets that provide more in-depth detail on the wider processes.
When will I receive my joining instructions?
Joining instructions for QA courses are sent two weeks prior to the course start date, or immediately if the booking is confirmed within this timeframe. For course bookings made via QA but delivered by a third-party supplier, joining instructions are sent to attendees prior to the training course, but timescales vary depending on each supplier’s terms. Read more FAQs.
When will I receive my certificate?
Certificates of Achievement are issued at the end the course, either as a hard copy or via email. Read more here.