AI DevSecOps
Secure delivery for AI systems: pipelines, policy as code, secrets, and supply chain.
Who this is for
Engineers who own the pipeline that ships models and agents into production.
What you should be able to do
Ship through a pipeline that blocks on policy, scans dependencies, and never prints a secret.
Career ladder
The titles this track maps onto. Levels differ between companies — the useful part is the direction, and what each step adds to the one before it.
- DevOps Engineer
- DevSecOps Engineer
- Senior DevSecOps Engineer
- Staff Security Engineer
- Principal Security Architect
Tech stack
What the work is actually done with. Grouped by the job each tool does, so the list reads as a system rather than a pile of names.
- CI/CD
- GitHub ActionsAzure DevOpsArgo CD
- Policy
- OPAConftestSentinel
- Supply chain
- SBOMSigstoreDependency scanning
- Secrets
- VaultAWS Secrets ManagerAzure Key VaultOIDC federation
The delivery flow
The order the work actually happens in. Each step is where a decision gets made and written down, not a chapter heading.
- Threat model the pipeline
- Least-privilege CI identity
- Dependency + SBOM scan
- Policy as code gate
- Secret scanning
- Signed artifacts
- Deploy
- Audit trail
Reference repository structure
A starting layout for this track. The directories are the ones that get added late and hurt — decisions, evals, policy, lineage — promoted to the top level where they are visible.
delivery/ ├── .github/workflows/ # least-privilege, OIDC not long-lived keys ├── policy/ │ ├── opa/ # deny-by-default, tested │ └── tests/ ├── supply-chain/ │ ├── sbom/ │ └── signing/ ├── secrets/ # references only, never values ├── scanning/ │ ├── deps/ │ └── secrets-scan/ └── runbooks/
Reference implementations
Citadel’s open-source repositories for this track — Terraform modules, MCP servers, and reference architectures you can read, fork, and run. Apache/MIT licensed; check each repository for its terms.
- GitHubdevops-templates-productionProduction-ready DevOps templates: GitHub Actions CI/CD, Terraform modules, Kubernetes manifests, Docker configs, monitoring.devops-templates-production on github.com (external site, opens in a new tab)
- GitHubterraform-aws-security-baselineAWS security baseline module with GuardDuty, Security Hub, Config, CloudTrail, Macie, and Access Analyzerterraform-aws-security-baseline on github.com (external site, opens in a new tab)
- GitHubmcp-server-devopsMCP server for DevOps operations - Docker, Helm, Ansible, Jenkins, and Terraformmcp-server-devops on github.com (external site, opens in a new tab)
- GitHubterraform-aws-guardduty-aiAI-enhanced GuardDuty module with threat intelligence, automated triage, and Security Hub integrationterraform-aws-guardduty-ai on github.com (external site, opens in a new tab)
- GitHubterraform-azure-key-vaultAzure Key Vault Terraform module with RBAC, private endpoint, HSM keys, certificates, and diagnosticsterraform-azure-key-vault on github.com (external site, opens in a new tab)
Primary sources
The standards, framework documents, and vendor references this track is built against. Go here when you need the authoritative wording rather than a summary — in a security review or an audit, the source is what counts.
- OWASP Top 10 for LLM Applications (external site, opens in a new tab)
- SLSA supply chain framework (external site, opens in a new tab)
- Sigstore documentation (external site, opens in a new tab)
- Open Policy Agent documentation (external site, opens in a new tab)
- GitHub Actions security hardening (external site, opens in a new tab)
- CISA Secure by Design (external site, opens in a new tab)