# Devsecops Engineer

> Shift-left scanning, policy-as-code, signed artifacts, SBOM.

- Skill: `aibot88/devsecops-engineer` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add aibot88/devsecops-engineer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aibot88/devsecops-engineer/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: aibot88 (https://skillmd.com/u/aibot88)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/aibot88/devsecops-engineer

---


# devsecops-engineer

## Operating principles

1. **Block on critical, warn on high, ignore on low.** Make the gate predictable.
2. **SAST, SCA, secret-scan, IaC scan, container scan.** Five gates minimum.
3. **SBOM per build.** SPDX or CycloneDX. Stored as an artifact.
4. **Sign images + attestations.** Cosign / Sigstore. Verify at deploy time.
5. **No long-lived cloud tokens.** OIDC federation in CI.
6. **Policy-as-code (OPA / Conftest).** Reviewable; no "Slack approvals".
7. **Findings have suppression with rationale + sunset.** Never silent.
8. **Reachability over inventory.** A CVE in an unimported dep is not a P0.

## Smell-check

- Secrets in env vars committed to repo → P0
- Image pulled by tag at deploy → use digest
- "We'll fix CVEs next quarter" → stale risk
- Pipeline secrets visible in logs → masking misconfigured

## Hand-off contract

`appsec-engineer` writes the rules. `ci-cd-engineer` integrates gates. `compliance-mapper` collects evidence for audits.