DevSecOps engineers build security into the software delivery pipeline instead of checking it at the end. Interviews for these roles mix DevOps, application security and cloud security. These DevSecOps interview questions cover the concepts, tools and scenarios that come up most often, with practical answers.
Concepts
1. What is DevSecOps?
DevSecOps integrates security into every stage of development and operations: planning, coding, building, testing, deploying and running. Security becomes a shared responsibility, supported by automation, rather than a final gate owned by one team.
2. What does “shift left” mean?
It means finding security issues earlier, for example during design and coding instead of after release. Early fixes are faster and cheaper. However, you should also “shift right” by monitoring production.
3. How do you measure DevSecOps success?
Useful metrics include mean time to remediate vulnerabilities, the number of critical findings reaching production, the share of builds with security scans, and how often secrets are detected before merge.
Pipeline security testing
4. Explain SAST, DAST, SCA and IAST.
| Type | What it tests | When | Example tools |
|---|---|---|---|
| SAST | Source code for insecure patterns | On commit or pull request | Semgrep, SonarQube, CodeQL |
| SCA | Third-party dependencies for known CVEs and licences | On build | Dependabot, Trivy, OWASP Dependency-Check |
| DAST | A running application from the outside | In test or staging | OWASP ZAP, Burp Suite |
| IAST | The app from inside while tests run | In test | Agent-based commercial tools |
5. How do you avoid slowing developers down?
Run fast checks on every pull request and heavier scans nightly. Tune rules to cut false positives, block only on high-severity issues, and give clear fix guidance inside the developer’s tools.
6. What is IaC scanning?
It checks infrastructure code, such as Terraform, CloudFormation or Kubernetes manifests, for misconfigurations before deployment. Tools include Checkov, tfsec (now part of Trivy) and KICS.
Secrets and supply chain
7. How do you manage secrets?
Store them in a secrets manager, such as HashiCorp Vault, AWS Secrets Manager or Azure Key Vault. Inject them at runtime, rotate them regularly and never commit them to Git. In addition, scan repositories with tools like Gitleaks or GitHub secret scanning.
8. What is an SBOM?
A software bill of materials lists every component in an application. Formats include SPDX and CycloneDX. When a new vulnerability appears, an SBOM shows quickly which applications are affected.
9. How do you secure the software supply chain?
- Pin and verify dependencies.
- Sign artefacts and container images, for example with Sigstore Cosign.
- Generate SBOMs and provenance, following frameworks like SLSA.
- Protect CI/CD runners and limit their permissions.
- Use private registries and approved base images.
The SolarWinds attack shows why this matters; see our case study.
Containers and Kubernetes
10. How do you secure container images?
Use minimal base images, scan images for vulnerabilities, run as non-root, avoid secrets in layers and rebuild regularly to pick up patches.
11. Name key Kubernetes security controls.
- RBAC with least privilege.
- Pod Security Standards (restricted profile where possible).
- Network policies to limit pod-to-pod traffic.
- Secrets encryption at rest and external secret stores.
- Admission control and policy as code, such as Kyverno or OPA Gatekeeper.
- Runtime detection, for example with Falco.
12. What is policy as code?
Security and compliance rules written as code and enforced automatically, for example blocking privileged containers or public storage buckets.
Cloud and operations
13. What is CSPM?
Cloud security posture management continuously checks cloud accounts for misconfigurations, such as open storage or missing MFA.
14. How do you handle a critical vulnerability found in production?
Assess exposure and exploitability, apply a fix or mitigation such as a WAF rule, patch through the normal pipeline with expedited approval, verify, and then review why earlier checks missed it.
15. Why does logging matter in DevSecOps?
Without good logs, you cannot detect or investigate attacks. Centralise application, pipeline and cloud logs in a SIEM and alert on suspicious activity. Our guide to building a SOC lab with Wazuh is a good place to practise.
Secure design
16. What is threat modelling?
A structured way to find threats early in design. Methods like STRIDE ask what could be spoofed, tampered with, repudiated, disclosed, denied or elevated.
17. Name some items from the OWASP Top 10.
Broken access control, cryptographic failures, injection, insecure design, security misconfiguration and vulnerable components are common examples.
18. Scenario: a developer pushed an AWS key to a public repository. What do you do?
Revoke and rotate the key immediately, check CloudTrail for misuse, remove the key from history, and add pre-commit secret scanning to prevent repeats.
Keep preparing
Practise each answer out loud, and run the commands in a lab rather than memorising them. Interviewers often ask follow-up questions, so make sure you understand why each answer is true.
Sources
Preparing for an interview? Browse more questions in our interview preparation hub. For businesses, we also offer security services such as VAPT, server hardening and ISO 27001 readiness.
