SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
SEC595Cyber Defense, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
UPDATED
SEC540: Cloud Native Security and DevSecOps Automation
SEC540Cloud Security
- 5 Days (Instructor-Led)
- 38 Hours (Self-Paced)
Course authored by:
Eric Johnson, Ben Allen & Frank Kim
Course authored by:Eric Johnson, Ben Allen & Frank Kim
- GIAC Cloud Security Automation (GCSA)
- 38 CPEs
Apply your credits to renew your certifications
- In-Person, Virtual or Self-Paced
Attend a live, instructor-led class at a location near you or remotely, or train on your time over 4 months
- Advanced Skill Level
Course material is geared for cyber security professionals with hands-on experience
- 19 Hands-On Lab(s)
Apply what you learn with hands-on exercises and labs
Gain the skills and methodology to secure modern Cloud Native, DevSecOps, and Kubernetes environments through hands-on labs using security controls in CI/CD pipelines for cloud systems.
Featured Quote
BEST class I have ever taken at SANS. This is one of those courses where I can log into work after class ends and immediately start applying into my daily tasks and responsibilities. I already went on my team's Slack channel and told them this needs to be the next class they take.
Course Overview
The SANS SEC540 DevSecOps training course prepares security professionals to secure cloud-native and DevOps environments by implementing security controls in automated pipelines. It addresses challenges like insecure CI/CD pipelines, container misconfigurations, software supply chain weaknesses, and Kubernetes vulnerabilities while providing hands-on labs to develop practical skills. The course equips students with the DevSecOps mindset needed to secure cloud native environments.
What You'll Learn
- Understand DevOps principles for secure workflows
- Integrate AI security tools into developer environments and CI/CD pipelines
- Manage secrets and automate infrastructure with IaC
- Harden and monitor containers and Kubernetes workloads
- Secure software supply chain with SBOMs and artifact signing
- Defend microservices using cloud native identity provider and API Gateway services
- Automate compliance with policy guardrails and remediation
Business Takeaways
- Build a security team skilled in DevSecOps, AI, and cloud-native security
- Collaborate with DevOps to integrate security and AI guardrails early in development
- Utilize cloud-native services for deployment, hardening, and monitoring
- Prepare for container and Kubernetes migrations with adaptability
- Enhance security with API Gateway and cloud native observability services
- Implement centralized audit pipelines and policy-as-code
Meet Your Authors
- Slide 1 of 3
Eric Johnson
FellowEric is a co-founder and principal security engineer at Puma Security, focusing on cloud security, Kubernetes, and DevSecOps automation. A SANS Fellow, he is co-author and instructor for three SANS Cloud Security courses.
Read more about Eric Johnson - Slide 2 of 3
Ben Allen
Ben Allen is a Cloud Security Architect at the SANS Institute and a co-author of SEC540: Cloud Security and DevSecOps Automation.
Read more about Ben Allen - Slide 3 of 3
Frank Kim
FellowSANS Fellow Frank Kim helps to develop the next generation of CISOs and cyber leaders while teaching LDR512 and LDR514.
Read more about Frank Kim
Slide 1 of 0
(1/0)
Course Syllabus
Explore the course syllabus below to view the full range of topics covered in SEC540: Cloud Native Security and DevSecOps Automation.
Section 1DevOps Security Automation
This section introduces DevOps practices by analyzing and securing a vulnerable Version Control and Continuous Integration (CI) system, teaching students to configure AI agents that help identify risks and run DevOps tools that harden workflows, automate code analysis, and securely manage secrets.
Topics covered
- DevOps and Security Challenges
- DevOps Toolchain
- Pre-Commit Security Controls
- Pre-Merge Security Controls
- Secrets Management
Labs
- Attacking the DevOps Toolchain
- Configuring Pre-Commit Security Controls
- AI-Assisted Merge Request Reviews
- Protecting Secrets with Vault
- CloudWars Bonus Challenges
Section 2Cloud Infrastructure Security
In section two, students deploy cloud infrastructure with Terraform, harden network configurations, automate configuration management with Packer and Ansible, and secure container images for Kubernetes by managing misconfigurations, scanning for vulnerabilities, and securing the software supply chain with SBOMs and artifact signing.
Topics covered
- Cloud Infrastructure as Code
- Configuration Management as Code
- Container Security Lifecycle
- Software Supply Chain Security
Labs
- Infrastructure as Code Network Hardening
- Gold Image Creation
- Container Image Hardening
- Container Software Supply Chain Security
- CloudWars Bonus Challenges
Section 3Cloud Native Security Operations
In section three, students start by learning the Kubernetes control plane, the kubectl command line interface, and how to use AI to interact with clusters hosted in cloud services like AWS EKS and Azure AKS. Then, harden the cluster using security controls such as RBAC, workload identity, and admission control.
Topics covered
- Kubernetes Architecture, Resources, and Kubectl
- Kubernetes Risks and Security Controls
- Kubernetes Workload Security
- Kubernetes Runtime Security
- Continuous Security Monitoring
Labs
- Kubectl and AI Assistants
- Kubernetes Role-Based Access Control
- Kubernetes Workload Identity
- Kubernetes Admission Control
- CloudWars Bonus Challenges
Section 4Microservice Security
In section four, students learn how security changes with microservices and how to implement centralized microservice security controls. We establish edge authentication and authorization with cloud native tooling, build network policy to govern service to service communication, deploy microservice patches with zero downtime, and enable OpenTelemetry.
Topics covered
- Microservice Fundamentals
- Microservice User Interface and Identity Providers
- Microservice API Gateways
- Kubernetes Deployment Orchestration
- Cloud Native Security Observability
Labs
- Keycloak Identity and Access Management
- Kong Kubernetes Ingress Controller
- Kubernetes Blue/Green Deployments
- OpenTelemetry Observability
- CloudWars Bonus Challenges
Section 5Continuous Compliance
In section five, students learn to automate cloud security and Kubernetes compliance, aggregate and correlate vulnerabilities, and implement policy as code to stop deployments and auto remediate configuration drift.
Topics covered
- Compliance as Code
- Policy as Code
- Automated Remediation
Labs
- Cloud and Kubernetes Compliance
- Vulnerability Aggregation and Correlation
- Automated Remediation
- CloudWars Bonus Challenges
Things You Need To Know
Relevant Job Roles
Systems Security Analyst (DCWF 461)
DoD 8140: Software EngineeringEnsures systems and software security from development to maintenance by analyzing and improving security across all lifecycle phases.
Explore learning pathCloud Security Engineer Training, Salary, and Career Path
Cloud SecurityCloud Security Engineers integrate advanced security measures into cloud and cloud-native environments, maximize security automation within DevOps workflows, and proactively mitigate threats to safeguard modern cloud infrastructures.
Explore learning pathSystems Developer (DCWF 632)
DoD 8140: Cyber ITOversees full lifecycle of information systems from design through evaluation, ensuring alignment with functional and operational goals.
Explore learning pathVulnerability Assessment Analyst (DCWF 541)
DoD 8140: CybersecurityAssesses systems and networks to ensure compliance with policies and identify vulnerabilities in support of secure and resilient operations.
Explore learning pathTechnology Research and Development (OPM 661)
NICE: Design and DevelopmentResponsible for conducting software and systems engineering and software systems research to develop new capabilities with fully integrated cybersecurity. Conducts comprehensive technology research to evaluate potential vulnerabilities in cyberspace systems.
Explore learning pathIT Investment/Portfolio Manager (DCWF 804)
DoD 8140: Cyber EnablersOversees a portfolio of IT capabilities aligned to enterprise goals, prioritizing needs, solutions, and value delivery to the organization.
Explore learning pathCommunications Security (COMSEC) Management (OPM 723)
NICE: Oversight and GovernanceResponsible for managing the Communications Security (COMSEC) resources of an organization.
Explore learning pathInformation Systems Security Developer (DCWF 631)
DoD 8140: CybersecurityDesigns and evaluates information system security throughout the software lifecycle to ensure confidentiality, integrity, and availability.
Explore learning pathCourse Schedule and Pricing
Have Questions?Contact Us
Group and Private Pricing
Enroll your team as a group or arrange a private session for your organization. We’ll help you choose the format that fits your goals.
Location & instructorDate & TimeCourse priceRegistration Options
- Date & TimeOnDemand (Anytime)Self-Paced, 4 months accessCourse price$8,780 USD*Prices exclude applicable local taxesBuy now for access on Mar 27. Use code Presale10 for 10% off course price!Registration Options
- Date & TimeFetching schedule..Course price$8,780 USD*Prices exclude applicable local taxes
- Date & TimeFetching schedule..Course price$8,780 USD*Prices exclude applicable local taxes
- Date & TimeFetching schedule..Course price$8,780 USD*Prices exclude applicable local taxes
- Date & TimeFetching schedule..Course price€8,230 EUR*Prices exclude applicable local taxes
- Date & TimeFetching schedule..Course price$8,780 USD*Prices exclude applicable local taxes
- Date & TimeFetching schedule..Course price$8,900 USD*Prices exclude applicable local taxes
- Date & TimeFetching schedule..Course priceS$11,390 SGD*Prices exclude applicable local taxes
- Date & TimeFetching schedule..Course price$8,780 USD*Prices exclude applicable local taxes
- Location & instructor
SANS Cloud Security Exchange Summit & Training 2026
San Francisco, CA, US & Virtual (live)
Instructed byDate & TimeFetching schedule..Course price$8,780 USD*Prices exclude applicable local taxes
Showing 10 of 17
Learn Alongside Leading Cybersecurity Professionals From Around The World
- Slide 1 of 4Every single person I've sent to class has loved it. It's been transformational for them because it goes beyond security concepts and teaches how modern operations and DevOps works. It's also impactful sending developers (who are not working in cloud yet) because they want to develop in cloud and get into concepts like Infrastructure as Code.
- Slide 2 of 4This course definitely makes security in DevOps more relatable and concrete. Love that we are asked to fix issues.
- Slide 3 of 4Instructor is fantastic. Extremely knowledgeable in the subject matter and has easily answered many complicated questions.
- Slide 4 of 4SEC540 truly deserves the 5 of 5 excellent rating. I really can't express how impressed I am with my first SANS course.
Slide 1 of 0
(1/0)
Benefits of Learning with SANS
Get feedback from the world’s best cybersecurity experts and instructors
Choose how you want to learn - online, on demand, or at our live in-person training events
Get access to our range of industry-leading courses and resources