Skip to content
Cyber Courses
All roles
Role pathsIn preparation

CI/CD Security Engineer

CI/CD security engineers secure the pipelines that build and ship software. This path works through the OWASP Top 10 CI/CD security risks hands-on: poison a pipeline, abuse a dependency chain, bypass a flow-control gate, and recover the secrets a careless pipeline leaks.

Skills this role needs

The capstone skills for this role. Each folds in the prerequisites it depends on.

Pipeline fundamentals1 skills
  • Recover secrets from Git history
    0%

    Includes

    • Use a Git forge (clone, branch, fork, pull request)
Poisoned pipeline execution3 skills
  • Execute a Public (fork-based) Poisoned Pipeline Execution
    0%

    Includes

    • Use a Git forge (clone, branch, fork, pull request)
    • Read and understand a CI/CD pipeline
    • Execute a Direct Poisoned Pipeline Execution
  • Execute an Indirect Poisoned Pipeline Execution
    0%

    Includes

    • Use a Git forge (clone, branch, fork, pull request)
    • Read and understand a CI/CD pipeline
    • Execute a Direct Poisoned Pipeline Execution
  • Abuse weak pipeline access controls to reach the controller
    0%

    Includes

    • Use a Git forge (clone, branch, fork, pull request)
    • Read and understand a CI/CD pipeline
    • Execute a Direct Poisoned Pipeline Execution
Dependency chain abuse1 skills
  • Abuse a dependency chain to poison a pipeline
    0%

    Includes

    • Use a Git forge (clone, branch, fork, pull request)
Flow control and gates1 skills
  • Bypass a CI/CD flow-control or scan gate
    0%

    Includes

    • Read and understand a CI/CD pipeline
Identity and artifacts2 skills
  • Compromise and abuse a CI/CD identity
    0%

    Includes

    • Use a Git forge (clone, branch, fork, pull request)
  • Hijack a 3rd-party artifact used in a pipeline
    0%

    Includes

    • Read and understand a CI/CD pipeline

In preparation

This path is being built. Follow the courses meanwhile.

All courses

What the job involves

  • Map a pipeline's trigger, permissions and trust boundaries.
  • Exploit poisoned pipeline execution, dependency-chain and flow-control flaws.
  • Recover leaked credentials and prove artifact-integrity gaps.
  • Recommend fixes a platform team can apply.