DevSecOps Training in Nigeria: Embedding Security Into the Development Lifecycle
The Challenge An oil and gas company engaged Beyond Strides for DevSecOps training in Nigeria after identifying a critical gap in its software development process: security was being reviewed towards the end of the development lifecycle rather than embedded from the beginning. The engineering team needed more than a theoretical introduction to DevSecOps. They needed to understand how modern software moves from source code to infrastructure, containers, Kubernetes and production—and where security controls should be introduced throughout that journey. The objective was clear: help the team move from treating security as a final checkpoint to building security into the way applications are designed, deployed and operated. Our Approach Beyond Strides designed and delivered a five-day, in-person DevSecOps capability development programme built around practical engineering workflows. Rather than relying on generic slides or disconnected demonstrations, the training followed a working application through multiple stages of software delivery. Participants examined application architecture, deployed workloads to cloud infrastructure, containerised applications, provisioned infrastructure using code, deployed workloads to Kubernetes and integrated security checks into a CI/CD pipeline. Our approach followed a simple principle: Learn the concept. See the architecture. Build the system. Identify the risk. Introduce the security control. This allowed participants to understand not only which DevSecOps tools to use, but why each control exists and where it belongs in the development lifecycle. What the Five-Day DevSecOps Training Covered The programme began with the foundations of DevSecOps and modern software delivery. Participants explored the differences between Waterfall, DevOps and DevSecOps delivery models and examined how shifting security earlier in the development lifecycle changes engineering responsibility. Using a three-tier application architecture, the team worked through frontend, backend and database components before deploying an application to AWS EC2. This first deployment created an important learning point. A manually configured EC2 environment may work, but it quickly introduces questions around repeatability, scalability, configuration consistency and operational risk. From there, the programme moved into Infrastructure as Code. Participants learned YAML fundamentals and used Terraform to understand how cloud infrastructure can be defined, reviewed and provisioned through code. The team explored AWS networking concepts including Virtual Private Clouds, public and private subnets, internet gateways and NAT gateways before examining Amazon Elastic Kubernetes Service as a platform for running containerised workloads. From EC2 to Secure Cloud-Native Delivery The next stage focused on containerisation. Participants compared containers with traditional virtual machines and worked with Docker to package application components into portable images. The training covered Dockerfiles, multi-stage builds, Docker Compose, container registries and the use of Nginx as a reverse proxy. But the objective was not simply to teach Docker commands. The team examined how container design decisions can create security risks, including excessive privileges, poor image practices and insecure runtime configurations. The programme then moved into Kubernetes. Participants worked with deployments, StatefulSets, ReplicaSets, services and namespaces. They explored Kubernetes networking, persistent storage, secrets and security contexts. Security was introduced as part of the architecture rather than as a separate topic. The team examined NetworkPolicies, pod and container security contexts, Kubernetes secrets and production patterns for managing sensitive information. GitOps principles were also introduced using Argo CD, helping participants understand how Git can become the source of truth for application deployment and infrastructure changes. Embedding Security Into CI/CD The final stage of the DevSecOps training in Nigeria focused on integrating security directly into the software delivery pipeline. Participants explored CI/CD concepts using GitHub Actions and examined how automated workflows can test, build, scan and prepare applications for deployment. Security controls were introduced at different stages of the pipeline. Software Composition Analysis helped the team understand how vulnerable third-party dependencies can introduce risk into an application. Container image scanning with Trivy demonstrated how known vulnerabilities can be identified before an image reaches production. Infrastructure as Code scanning with Checkov showed how Terraform and Kubernetes configurations can be assessed for security misconfigurations. Dockerfile linting introduced another layer of preventative control by identifying poor container build practices earlier in the development process. The programme also introduced STRIDE threat modelling, enabling participants to think systematically about spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege. By the end of the programme, security was no longer presented as the responsibility of a separate team reviewing finished software. It had become part of architecture, infrastructure, containerisation, deployment and CI/CD. The Outcome The engineering team completed the programme with a clearer understanding of how DevSecOps works across the full software delivery lifecycle. Participants had moved from discussing DevSecOps as a concept to working through the technologies and security controls that support secure software delivery. More importantly, the training connected tools that are often taught separately. AWS, Terraform, Docker, Kubernetes, GitHub Actions and security scanning were presented as parts of one delivery system rather than isolated technical skills. The engagement demonstrated the value of capability development built around real engineering workflows. Why It Matters Technology training should do more than introduce tools. Teams need to understand how architecture decisions, infrastructure, deployment processes and security controls connect to business and operational risk. At Beyond Strides, our capability development programmes are designed around this principle. We diagnose the capability gap, design the learning experience around the organisation’s environment and deliver practical programmes that help teams apply what they learn. This DevSecOps training in Nigeria became a proof point for that approach: moving beyond generic training towards practical capability development built around real systems, real workflows and real engineering decisions.