DevSecOps for Kubernetes and CI/CD pipelines
We build security into the delivery pipeline and the platform underneath it: scanning that blocks real risk without drowning developers in noise, secrets that never land in Git, least-privilege access in Kubernetes and the cloud, and evidence your auditors can check.
What DevSecOps means in our engagements
DevSecOps is DevOps with security controls built into every stage instead of a review at the end. In practice we add code, dependency, secret and container image scanning to CI/CD (Trivy, Grype, Semgrep, SonarQube, Gitleaks), move secrets into Vault, OpenBao or a cloud secret manager with External Secrets Operator, lock down Kubernetes RBAC, network policies and egress, and collect the findings in DefectDojo so they are triaged and fixed rather than ignored.
Our engineers have built and hardened infrastructure for banking and payment platforms to PCI DSS requirements. We implement and document the technical controls; certification itself stays with your auditor.
When teams call us about DevSecOps
- Scanners run, but nobody owns the findings and the backlog only grows.
- Secrets live in Git, CI variables or copied Kubernetes Secrets with no owner or rotation.
- A customer, auditor or PCI DSS, ISO 27001, SOC 2 or NIS2 assessment asks for evidence you can’t produce yet.
- Every pod can reach the internet and every service account can do more than it needs.
- Releases are blocked by security checks that developers no longer trust.
What we do
- Secure CI/CD pipelines
- SAST, dependency (SCA), secret and container image scanning with Semgrep, SonarQube, Trivy, Grype, Gitleaks and TruffleHog, with thresholds and an exception policy so the gate blocks real risk.
- Runner and CI identity isolation
- Separate trust levels for pull request tests, releases and deployments, clean execution environments per job, cache isolation and short-lived OIDC credentials scoped by repository, environment and operation.
- Supply chain and images
- Minimal base images, pinned and verified build inputs, immutable image tags and registry scanning with JFrog Xray or Trivy, so you know which source produced what runs in production.
- Secrets management
- HashiCorp Vault, OpenBao, AWS Secrets Manager, Google Secret Manager or Azure Key Vault, delivered to workloads with External Secrets Operator, with ownership, rotation and audit designed in.
- Kubernetes and cloud hardening
- Least-privilege RBAC and IAM, workload identity, network policies with Cilium, default-deny egress, admission rules, TLS with cert-manager and private access through Pomerium, Tailscale or Cloudflare Tunnel.
- Vulnerability management
- Findings from every scanner and DAST runs with OWASP ZAP collected in DefectDojo or Wiz, deduplicated, prioritised by exposure and routed to the team that can fix them.
- Compliance evidence
- Technical controls and the evidence behind them for PCI DSS, ISO 27001, SOC 2 or NIS2 assessments: access reviews, change history from Git, logging and retention, and documented exceptions.
How a DevSecOps engagement runs
Baseline
We map how an unreviewed change could reach production and rank the gaps by exploitability: pipelines, runners, clusters, cloud accounts and secrets handling.
Quick wins
Leaked secrets, public endpoints and over-privileged identities are fixed first.
Build the controls
Scanning, secrets management, policies and network rules added inside your existing pipelines and repositories. Harmless canary tests confirm that unauthorized actions are denied while approved delivery still works.
Hand over
Runbooks, an exception process and dashboards so your team keeps the controls working, or we keep running them.
Technology we work with
Code, dependency and image scanning
- Trivy
- Grype
- SonarQube
- Semgrep
- JFrog Xray
- Wiz
Secret detection
- Gitleaks
- TruffleHog
Dynamic testing and findings
- OWASP ZAP
- DefectDojo
Secrets and identity
- HashiCorp Vault
- OpenBao
- External Secrets Operator
- AWS Secrets Manager
- Google Secret Manager
- Azure Key Vault
- Keycloak
Network and access control
- Cilium
- Istio
- Envoy
- Kubernetes Gateway API
- Pomerium
- Tailscale
- Twingate
- WireGuard
- Cloudflare WAF
- Cloudflare Tunnel
- Bunny.net WAF
- cert-manager
Pipelines we secure
- GitHub Actions
- GitLab CI
- Jenkins
- Azure DevOps
- Bitbucket Pipelines
- Argo CD
- Terraform
- OpenTofu
Questions buyers ask us
-
DevOps automates how software is built, released and run. DevSecOps adds security controls to that same automation: scanning on every change, managed secrets, least-privilege access and enforced network rules, so security is checked continuously instead of in a separate review before release.
-
Trivy, Grype, SonarQube, Semgrep, Gitleaks, TruffleHog, JFrog Xray, OWASP ZAP, DefectDojo and Wiz for scanning and findings; HashiCorp Vault, OpenBao, External Secrets Operator, Keycloak and the AWS, Google Cloud and Azure secret managers for secrets and identity; Cilium, Istio, Pomerium and Cloudflare WAF for network and access control. We start with what you already have.
-
We separate pull request, release and deployment trust levels, use clean execution environments per job, isolate caches by trust level and replace broad static cloud keys with short-lived OIDC roles. Acceptance tests use synthetic resources to prove that low-trust jobs cannot assume deployment identities, alter trusted caches or reach unrelated services.
-
We implement the technical controls and produce the evidence auditors ask for, such as access reviews, change history, logging and vulnerability management. Our team has hardened infrastructure for banking and payment platforms to PCI DSS requirements. We are not an accredited auditor, so the assessment itself stays with yours.
-
We run automated dynamic testing with OWASP ZAP as part of the pipeline and fix what it finds. For a formal, independent penetration test report we recommend a specialised testing firm, and we fix the findings with you afterwards.
-
They should not. We tune thresholds, cache scan results and route findings to the right owner, so the gate blocks only what matters and developers keep trusting it.
From our blog
Your AI agent can become the attacker's operator
How untrusted emails, tickets and web pages can redirect tool-using agents; practical DevSecOps controls for permissions, approvals, audit and safe testing.
A clean container scan does not mean a secure Kubernetes deployment
Why a clean vulnerability scan is not a production security guarantee: image provenance, permissions, egress controls, secrets and runtime incident checks.
Your GitHub Actions runner is a security boundary, not just build capacity
Practical DevSecOps guidance on untrusted pull requests, ephemeral self-hosted runners, OIDC, cache isolation, credential scope and safe deployment permissions.
Shared Kubernetes secrets: why five applications should not create the same Secret
A practical Kubernetes secrets design for shared values across namespaces: ownership, ClusterExternalSecret, refresh, RBAC, audit, rotation and failure modes.
Kubernetes 1.34 reached upstream EOL: upgrade the dependencies, not just the cluster
Kubernetes 1.34 reached upstream end of life on 27 October 2026. Check APIs, webhooks, controllers, CNI/CSI, version skew and recovery before you upgrade.
When AI runs the cyberattack: what changed in 2026
Real-world AI-orchestrated cyberattacks, what autonomy actually means, and what DevSecOps teams must change in exposure, identity, detection and recovery.
Tell us about your setup
Describe what you run and what isn’t working: the cloud bill, response times, releases or recurring incidents. We reply within one business day with a suggested first step, usually a short call or an audit.
Prefer email? Write to info@bigbadbyte.com. Prefer to talk? Schedule a call.