Training Trains logo

DevSecOps Internship

Build security into every step of software delivery: secret scanning, dependency and container scanning, secure pipelines, cloud and Kubernetes security.

GitHub ActionsSemgrep / CodeQLTrivyOWASP ZAPDockerTerraform

What you'll work on

Full syllabus: all 60 graded tasks

These are the actual tasks the internship portal assigns for this domain. You submit each one with proof (a GitHub link or document) and a mentor reviews it.

Level 1: Foundations (24 tasks)
  1. What DevSecOps means. Write a one-page explanation of shifting security left, with a diagram of where security checks fit in a CI/CD pipeline.
  2. Secure your GitHub account. Turn on 2FA, review SSH keys and tokens, and enable branch protection on a repo named devsecops-internship.
  3. Find secrets in code. Plant a fake API key in a test repo, detect it with gitleaks or trufflehog, remove it from history and explain why rotation is still needed.
  4. Dependency scanning. Run npm audit or pip-audit on a sample project, list the vulnerabilities by severity and upgrade at least two.
  5. Enable Dependabot. Turn on Dependabot alerts and version updates for your repo and merge one generated pull request.
  6. Linux hardening basics. On a VM, create a non-root user, disable root SSH login, enable a firewall (ufw) and document each step.
  7. HTTPS and certificates. Explain TLS, then inspect the certificate chain of three websites and record issuer, expiry and key type.
  8. OWASP Top 10 summary. Summarise each OWASP Top 10 risk in two lines with one real-world example.
  9. First CI pipeline. Create a GitHub Actions workflow that installs dependencies and runs tests on every push.
  10. Docker basics. Containerise a small app and explain image layers, the base image and why smaller images are safer.
  11. Least privilege. Write examples of least privilege for a database user, a cloud account and a CI token.
  12. Security checklist for a web app. Write a 20-item security checklist your team could use before every release.
  13. Pre-commit hooks. Add pre-commit hooks that run secret scanning and linting before every commit.
  14. Password policy review. Review the password and MFA settings of three services you use and write recommendations.
  15. Security.txt and disclosure. Add a security.txt file to a site and write a short vulnerability disclosure policy.
  16. Branch protection rules. Require reviews, status checks and signed commits on main, and document each rule.
  17. Dependency licence check. List the licences of your project's dependencies and flag any that could be a problem.
  18. Log what matters. List which security events an app should log (logins, permission changes) and add three of them.
  19. Backup basics. Explain the 3-2-1 backup rule and back up a project database following it.
  20. Cookie security. Set Secure, HttpOnly and SameSite on cookies in a small app and show the headers.
  21. CORS review. Find a too-open CORS setting in a sample API and restrict it.
  22. Docker image tags. Explain why using the latest tag is risky and pin images by version or digest.
  23. Security champions. Write a one-page plan for a security champion role inside a development team.
  24. Vulnerability triage. Take 10 scanner findings and sort them into fix now, fix later and false positive, with reasons.
Level 2: Building real features (20 tasks)
  1. SAST in the pipeline. Add Semgrep or CodeQL to your CI so it fails on high-severity findings. Fix or justify each finding.
  2. Container image scanning. Scan your Docker image with Trivy or Grype, then reduce the vulnerabilities with a slimmer base image. Report before and after.
  3. Dockerfile best practices. Rewrite a Dockerfile to use a non-root user, pinned versions, multi-stage build and no secrets. Lint it with hadolint.
  4. DAST with OWASP ZAP. Run a ZAP baseline scan against a deliberately vulnerable local app (Juice Shop or DVWA) and explain three alerts.
  5. Secrets management. Move CI secrets into GitHub encrypted secrets or a vault, and show the app reading them at runtime.
  6. Infrastructure as Code scanning. Write a small Terraform file, scan it with Checkov or tfsec, and fix the misconfigurations it finds.
  7. Signed commits and releases. Set up signed commits and a tagged release, and explain how this protects the supply chain.
  8. SBOM generation. Generate a software bill of materials for your app with Syft or CycloneDX and explain what it is used for.
  9. Security headers. Add CSP, HSTS, X-Content-Type-Options and Referrer-Policy to a web app and verify them with securityheaders.com or curl.
  10. Threat model a feature. Threat-model a login feature with STRIDE and list the mitigations you would build.
  11. Secret rotation. Rotate a database password used by an app without downtime and document the steps.
  12. Least-privilege CI token. Reduce your CI workflow's GITHUB_TOKEN permissions to the minimum and test it still works.
  13. OIDC to the cloud. Let GitHub Actions deploy to a cloud account using OIDC instead of stored keys.
  14. Container runtime hardening. Run a container read-only, drop Linux capabilities and add a seccomp profile.
  15. Kubernetes secrets. Compare Kubernetes Secrets, sealed secrets and external secret managers and use one.
  16. Pipeline as code review. Review a CI/CD workflow file for injection risks (untrusted input in run steps) and fix them.
  17. API security testing. Test an API for broken object level authorisation by changing IDs and document the result.
  18. WAF basics. Put a web application firewall rule set (Cloudflare free rules or ModSecurity) in front of a test app.
  19. Compliance mapping. Map five of your pipeline controls to ISO 27001 or SOC 2 control areas.
  20. Security dashboard. Build a dashboard showing open vulnerabilities by severity and age across repos.
Level 3: Professional work and capstone (16 tasks)
  1. Kubernetes security basics. Deploy an app to a local cluster (kind or minikube) with resource limits, a non-root pod and a network policy.
  2. Policy as code. Write an OPA/Gatekeeper or Kyverno policy that blocks containers running as root, and show it rejecting one.
  3. Cloud security posture. In a free cloud account, review IAM users, public buckets and open ports using the provider's security tools, and fix what you find.
  4. Runtime monitoring. Install Falco (or a similar tool) in your lab and trigger one alert, then explain what it detected.
  5. Incident response drill. Write a runbook for a leaked API key: detect, contain, rotate, review and report. Walk through it once.
  6. Full secure pipeline. Build one pipeline that runs tests, SAST, dependency scan, image scan and deploys only when all pass.
  7. Security metrics. Define 5 DevSecOps metrics (for example time to fix critical issues) and show how you would collect them.
  8. Capstone: secure delivery. Deliver an app through a fully secured pipeline with documentation of every control, findings fixed, and a final security report.
  9. Supply chain levels. Explain SLSA levels and raise your project's build to at least level 2 with provenance.
  10. Signed images in Kubernetes. Sign an image with Cosign and enforce signature checks in your cluster.
  11. Chaos and security. Simulate a compromised pod and show which controls limit the damage.
  12. Cloud IAM review. Find unused permissions in a cloud account with an access analyser and remove them.
  13. Red team your pipeline. Try (in your own lab) to sneak a malicious dependency into a build and document which control stops it.
  14. Tabletop exercise. Run a tabletop exercise for a ransomware scenario with classmates and record lessons learned.
  15. DevSecOps maturity assessment. Assess a project with the OWASP DevSecOps Maturity Model and plan the next level.
  16. Capstone 2: platform security baseline. Deliver a reusable secure template repo (CI with all scans, signed releases, policies, docs) that any new project can start from.

Real software work, not just training

Every DevSecOps task is reviewed by our team and saved to your portfolio. Interns who pass the readiness check can take real work from Training Trains, W3AppDevelopers and DomainHostly projects on the Company Work board.

Cyber SecurityHosting and Domain Solutions
See the software we build →

Frequently asked questions

Do I need experience to join the DevSecOps internship?+

Basic Linux, Git and some programming help. Security concepts are taught from the start.

What will I do in the DevSecOps internship?+

You complete 60 graded tasks in three levels: foundations, real features, and professional work. Each task is submitted with GitHub or document proof and reviewed. The final capstone is: Capstone 2: platform security baseline.

Do I get a certificate for the DevSecOps internship?+

Yes. After your required tasks are approved, your attendance is above 75% and you pass the proctored final exam, you get a graded completion certificate that anyone can verify at trainingtrains.com/verify.

Can I do the DevSecOps internship online?+

Yes. You can do it fully online from home, or offline at our Erode and Perundurai branches. Tasks, quizzes and mentor reviews are the same in both modes.

Available both online (work from home) and offline at our Erode and Perundurai branches - see the full internship program details for departments, duration, and the application process.

Apply for the DevSecOps internship