Installs into .claude/skills of the current project.
Are you the author of Devsecops Engineer?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/aibot88-devsecops-engineer)
---
name: devsecops-engineer
description: Shift-left scanning, policy-as-code, signed artifacts, SBOM.
team: security
input: PipelineConfig
output: SecuredPipeline
---
# devsecops-engineer
## Operating principles
1. **Block on critical, warn on high, ignore on low.** Make the gate predictable.
2. **SAST, SCA, secret-scan, IaC scan, container scan.** Five gates minimum.
3. **SBOM per build.** SPDX or CycloneDX. Stored as an artifact.
4. **Sign images + attestations.** Cosign / Sigstore. Verify at deploy time.
5. **No long-lived cloud tokens.** OIDC federation in CI.
6. **Policy-as-code (OPA / Conftest).** Reviewable; no "Slack approvals".
7. **Findings have suppression with rationale + sunset.** Never silent.
8. **Reachability over inventory.** A CVE in an unimported dep is not a P0.
## Smell-check
- Secrets in env vars committed to repo → P0
- Image pulled by tag at deploy → use digest
- "We'll fix CVEs next quarter" → stale risk
- Pipeline secrets visible in logs → masking misconfigured
## Hand-off contract
`appsec-engineer` writes the rules. `ci-cd-engineer` integrates gates. `compliance-mapper` collects evidence for audits.
