Security is no longer a responsibility that can be delegated to a separate team at the end of a release cycle. For DevOps engineers who own the development, delivery, and operation of critical applications, understanding security principles is increasingly part of the job. The challenge is knowing where to start.
The following curated list — originally sourced from Threat Stack — covers conferences, websites, training courses, books, social media accounts, and online communities worth exploring as you build your security knowledge.
1. Conferences
In-person conferences remain one of the most effective ways to learn from practitioners and build a network in a new discipline. Several events are particularly well-suited to DevOps engineers exploring security.
Security BSides is a community-driven conference series with events held in cities around the world. The format is deliberately accessible — BSides events are designed to welcome newcomers alongside veterans, making them a low-barrier entry point into the security community.
DevOpsDays events have incorporated a growing volume of security content into their programs. Attendees at recent DevOpsDays events have reported that a significant portion of talks touched on security topics, reflecting how central security has become to modern DevOps practice. DevOpsDays events are held in cities globally throughout the year; check devopsdays.org for the current schedule.
Larger industry conferences such as LISA (hosted by USENIX) and Velocity also regularly include security-focused sessions. Reviewing the published schedules from previous years is a useful way to gauge whether a given conference will deliver content relevant to your needs before you commit to attending.
2. Websites
A handful of security-focused websites consistently publish high-quality, practical content that is relevant to engineers working in cloud and DevOps environments.
- Medium’s Starting Up Security — A publication focused on practical, actionable security guidance for engineering and product teams. Topics range from building a product security function to investigating cloud audit logs.
- Krebs on Security (krebsonsecurity.com) — Run by independent journalist Brian Krebs, this site covers real-world cybercrime, data breaches, and emerging threats in depth. It is a good resource for understanding what kinds of attacks are active in the wild and how organizations are affected.
- Threatpost (threatpost.com) — An independent security news site covering vulnerabilities, cloud security, IoT threats, and policy developments. It provides broad coverage that helps engineers stay aware of the current threat landscape.
Beyond these, look for blogs maintained by security researchers and vendors in the DevSecOps space. Many publish detailed post-mortems, threat analyses, and implementation guides that are directly applicable to infrastructure and application work.
3. Training Courses and Certifications
If you want structured, verifiable security education, SANS Institute is one of the most respected providers in the field. SANS offers both live in-person courses and on-demand online training covering a wide range of security disciplines, from security operations to cloud security to application security.
SANS also administers the GIAC (Global Information Assurance Certification) program, which produces role-specific credentials that are well-regarded by employers. For those seeking a more comprehensive academic qualification, SANS offers a Master of Science in Information Security Engineering (MSISE).
Importantly, SANS maintains a free library of whitepapers, research, and reading room materials. This is a useful starting point before committing to a paid course.
Other training platforms worth exploring include:
- Cybrary — Free and paid courses covering security fundamentals and certifications.
- Offensive Security — Hands-on, practical training for those interested in penetration testing and offensive security techniques.
- Cloud provider security training — AWS, Google Cloud, and Microsoft Azure all offer security-focused learning paths and certifications relevant to DevOps engineers working in those environments.
4. Books
For engineers who prefer to learn from books, a few titles stand out as particularly useful starting points.
DevOpsSec by O’Reilly Media — This eBook uses real-world case studies to explain how security practices can be integrated into a DevOps workflow. It was available as a free download from O’Reilly at the time of the original article; availability may have changed.
Security Engineering by Ross Anderson — A comprehensive textbook covering information security from foundational principles to complex real-world systems. It is not a hands-on implementation guide, but it provides the conceptual grounding that makes other security learning click. A free version of an earlier edition has been made available by the author on his university webpage.
Other books worth noting for DevOps engineers include The Phoenix Project for organizational context, and O’Reilly titles on specific topics such as web application security, container security, and cloud security architecture.
5. Social Media and Security Practitioners to Follow
Twitter (now X) has historically been a primary channel for the security community to share research, disclose vulnerabilities, and discuss emerging threats in near real-time. Following practitioners gives you a pulse on what is happening in the field before it appears in formal publications.
The following handles were recommended by Threat Stack as useful accounts for DevOps engineers interested in security. Note that account activity and relevance may have changed since the original article was published in 2017:
- @duo_labs
- @duosec
- @pwnallthethings
- @robertmlee
- @hacks4pancakes
- @benjammingh
- @alexstamos
- @tqbf
- @thegrugg
- @jessysaurusrex
- @taviso
- @dguido
- @flyryan
Beyond Twitter/X, LinkedIn has grown as a platform for security professionals sharing long-form analysis. Mastodon’s infosec community (infosec.exchange) has also become active as an alternative social platform for the security field.
6. Forums and Online Communities
Engaging with communities where you can ask questions and discuss real problems accelerates learning considerably.
- HangOps #infosec (Slack) — A Slack community for operations and DevOps practitioners with a dedicated infosec channel. Access is available at signup.hangops.com.
- Information Security Stack Exchange (security.stackexchange.com) — A Q&A forum with a large, active community covering a broad range of security topics. The question archive alone is a valuable reference.
- Reddit — Subreddits such as r/netsec, r/devops, and r/AskNetsec contain active discussions and resource-sharing relevant to engineers at all levels.
- OWASP Community — The Open Worldwide Application Security Project maintains active working groups, local chapters, and a Slack workspace focused on application security.
Getting Started
Security can feel like a vast and opaque domain when you are coming at it from a development or operations background. The resources above are a practical starting point rather than an exhaustive curriculum. A reasonable approach is to begin with one or two website subscriptions to build awareness of current threats, attend a local BSides or DevOpsDays event to build community connections, and work through a structured SANS course or certification if you need to demonstrate formal competency.
The most important step is simply to start. Security knowledge compounds over time, and even a basic grounding in the principles will make you a significantly more effective DevOps engineer.