What is DevSecOps and how does it change where security happens in delivery?
Quick Answer
DevSecOps is used for secure software delivery, running at the every stage stage. Explain the class of problem it catches, why catching it there is cheaper than catching it in production, and how it reports findings back to developers.
Detailed Answer
Describe DevSecOps by the failure it prevents, not by its feature list. It belongs to secure software delivery and runs at the every stage stage of delivery, which matters because the cost of fixing a defect rises sharply the later it is found — the core argument behind shifting security left.
Strong answers cover shifting security left, running SAST/DAST/SCA on every commit, failing the pipeline fast on critical findings, secrets scanning before code is ever pushed, policy-as-code admission gates, and triaging findings without blocking delivery. Interviewers also listen for the operational side: who owns the rules, how findings reach the developer who introduced them, how false positives get suppressed without silently disabling coverage, and what the break-glass path is when a fix genuinely cannot ship in time.
Tie it to the wider toolchain. Security scanning is only useful when its output is actionable, deduplicated across tools, and attached to a specific commit, image digest or resource — otherwise teams learn to ignore it.
Code Example
# Where DevSecOps sits in the pipeline # stage: every stage # 1. run the scan against the artifact produced by this stage # 2. compare findings against the agreed severity threshold # 3. a critical finding at any stage stops the build before it can reach production # 4. publish the report so developers see it on the commit or pull request
Interview Tip
Anchor DevSecOps to a stage and a gate: what it scans, when it runs, and what makes the build stop.