How do you implement DevSecOps in a pipeline?
⚡
Quick Answer
Embed automated security gates across CI/CD: SAST and dependency scanning on commit/PR, secret scanning, container image and IaC scanning before deploy, DAST against staging, and policy-as-code at admission — failing the build on critical findings.
Detailed Answer
Sequence controls by stage and keep them fast so they do not block flow: pre-commit hooks and IDE checks, SAST/SCA in CI, image and IaC scans on build, DAST on a deployed environment, and runtime/admission policies (Kyverno/OPA) in the cluster. Tune severity thresholds to avoid alert fatigue, and give developers actionable results.
💡
Interview Tip
Map each scan type to its pipeline stage and mention tuning thresholds to avoid noise — practicality wins here.
devsecopspipelinesast-dast