<p>I'd agree this is a buzzword as much as DevOps can be.</p>

<p>Main task of a SecOps added on top of an usual operational engineer tasks is to take the burden of following CVE publication feeds, handling the remediation, usually handling things historically handled by the security or network administration team (Firewall rules, Web Applications Firewall exceptions)</p>

<p>If you see a Sysadmin in a DevOps org as a sysadmin able to read and be part of the application code, a SecOps would be a sysadmin able to be part of the security rules of the infrastructure around the servers themselves.</p>

<p>In some structure keeping silos of responsibility (Sales, Business, Dev, Ops, Security, Monitoring), Security Engineer and Operation Engineers are as separated as Developers and Operations Engineers, while not embracing a full DevOps organization, moving to a SecOps model is a first step to reunite two separated team historically closer and less antagonist in the silo based organization. Some people are also more comfortable to add either the operation or security facet in their current job than growing code skills.</p>

<p>To summarize, I would define SecOps as a first step toward a DevOps org, aiming at getting a multi-skill team around security/network/operating systems engineers where they are separate teams in an existing department.</p>

CC BY-SA 4.0
2017-03-27T13:44:58.817Z
2018-10-30T21:29:58.637Z
2018-10-30T21:29:58.637Z
Tensibai
<p>I do agree with <a href="https://devops.stackexchange.com/a/688/397">Tensibai's Answer</a> in that SecOps is as much as a buzz-word as DevOps itself and that SecOps is a stepping stone between a siloed organisation and cohesive organisation.</p>

<p>I have observed the flip side to also be true, that is, if you have an organisation who is operating using a DevOps Model, with DevOps ways of working and following DevOps Practice, they may appoint someone in a SecOps role to integrate <a href="https://en.wikipedia.org/wiki/Computer_security" rel="noreferrer">IT Security</a> practice into the model.</p>

<p>Quite commonly this is branded as DevSecOps or DevOpsSec so as to bridge all three disciplines.</p>

<p>Further Reading:</p>

<ul>
<li><a href="https://www.safaribooksonline.com/library/view/devopssec/9781491971413/" rel="noreferrer">DevOpsSec by Jim Bird</a></li>
<li><a href="http://www.devseccon.com/" rel="noreferrer">DevSecCon: A DevSecOps Conference</a></li>
<li><a href="https://www.safaribooksonline.com/library/view/velocity-2016-/9781491958537/video290680.html" rel="noreferrer">Velocity EU: Continuous Security</a></li>
</ul>

<p>Of the above I am currently reading Jim Bird's book, have had the pleasure of working with <a href="https://www.linkedin.com/in/francoisraynaud" rel="noreferrer">the organizer</a> of DevSecCon in a previous role and had the privalage of attending the Velocity Session in Amsterdam last year.</p>

CC BY-SA 3.0
2017-09-28T00:16:45.120Z
I've recently become acquainted with Alan Shimel (http://www.ashimmy.com) as a guest on the DevOps Cafe podcast.  Another great resource.
Stuart Ainsworth
CC BY-SA 4.0
2022-12-07T07:41:43.960Z
Alan Shimel's website isn't working at present.  He's associated with the group that publishes `devops.com`, and some of his articles are here: https://devops.com/author/ashimmy/
RichVel
CC BY-SA 3.0
2017-03-27T20:55:14.527Z
2017-03-27T20:55:14.527Z
2017-04-13T13:01:29.297Z
Richard Slater
<p>First when I heard the word SecOps, I thought of it as a management approach that aims to connect security and operations teams, in much the same way that DevOps unifies developers and operations team.  </p>

<p>But isn't security just a piece of the DevOps puzzle ?<br>
DevOps already includes processes like component monitoring ,version management, benchmarking, code review, continuous monitoring ..  </p>

<p>What other can SecOps add to a DevOps team , or is it another buzz word maybe ?</p>

<terminology><culture><security>
What Is SecOps?
storm
# What Is SecOps?

(Asked by: username_0 on 2017-03-27)

First when I heard the word SecOps, I thought of it as a management approach that aims to connect security and operations teams, in much the same way that DevOps unifies developers and operations team.

But isn't security just a piece of the DevOps puzzle ?  
DevOps already includes processes like component monitoring ,version management, benchmarking, code review, continuous monitoring ..

What other can SecOps add to a DevOps team , or is it another buzz word maybe ?

**Tags:** terminology, culture, security


---

## 2 answers

### Answer by username_1 on 2017-03-27. Score: 18 | Accepted answer

I'd agree this is a buzzword as much as DevOps can be.

Main task of a SecOps added on top of an usual operational engineer tasks is to take the burden of following CVE publication feeds, handling the remediation, usually handling things historically handled by the security or network administration team (Firewall rules, Web Applications Firewall exceptions)

If you see a Sysadmin in a DevOps org as a sysadmin able to read and be part of the application code, a SecOps would be a sysadmin able to be part of the security rules of the infrastructure around the servers themselves.

In some structure keeping silos of responsibility (Sales, Business, Dev, Ops, Security, Monitoring), Security Engineer and Operation Engineers are as separated as Developers and Operations Engineers, while not embracing a full DevOps organization, moving to a SecOps model is a first step to reunite two separated team historically closer and less antagonist in the silo based organization. Some people are also more comfortable to add either the operation or security facet in their current job than growing code skills.

To summarize, I would define SecOps as a first step toward a DevOps org, aiming at getting a multi-skill team around security/network/operating systems engineers where they are separate teams in an existing department.


---

### Answer by username_2 on 2017-03-27. Score: 9

I do agree with [username_1's Answer](https://devops.stackexchange.com/a/688/397) in that SecOps is as much as a buzz-word as DevOps itself and that SecOps is a stepping stone between a siloed organisation and cohesive organisation.

I have observed the flip side to also be true, that is, if you have an organisation who is operating using a DevOps Model, with DevOps ways of working and following DevOps Practice, they may appoint someone in a SecOps role to integrate [IT Security](https://en.wikipedia.org/wiki/Computer_security) practice into the model.

Quite commonly this is branded as DevSecOps or DevOpsSec so as to bridge all three disciplines.

Further Reading:

* [DevOpsSec by Jim Bird](https://www.safaribooksonline.com/library/view/devopssec/9781491971413/)
* [DevSecCon: A DevSecOps Conference](http://www.devseccon.com/)
* [Velocity EU: Continuous Security](https://www.safaribooksonline.com/library/view/velocity-2016-/9781491958537/video290680.html)

Of the above I am currently reading Jim Bird's book, have had the pleasure of working with [the organizer](https://www.linkedin.com/in/francoisraynaud) of DevSecCon in a previous role and had the privalage of attending the Velocity Session in Amsterdam last year.

> **Comments:**
> **username_3**: I've recently become acquainted with Alan Shimel (http://www.ashimmy.com) as a guest on the DevOps Cafe podcast.  Another great resource.  
> **username_4**: Alan Shimel's website isn't working at present.  He's associated with the group that publishes `devops.com`, and some of his articles are here: https://devops.com/author/ashimmy/  

---

