DevSecOps interview questions with answer outlines

Fifteen common DevSecOps interview questions

1. What is DevSecOps, and what does shift left mean?
2. SAST versus DAST versus SCA — what does each find?
3. Where in the pipeline would you place each security check?
4. How do you prevent secrets from reaching a repository?
5. How do you secure container images?
6. How do you scan infrastructure as code?
7. What is a software bill of materials (SBOM)?
8. How do you protect the software supply chain?
9. What is policy as code?
10. How do you prioritise vulnerabilities?
11. How do you avoid overwhelming developers with false positives?
12. How do you secure the CI/CD system itself?
13. What is threat modelling, and when do you do it?
14. What metrics show a DevSecOps programme is working?
15. Tell me about a security issue you caught in a pipeline.

Testing types and placement

The principle is to run fast, low-noise checks where developers already work — in the editor and on pull requests — and slower checks where they won't block flow. Block merges only on high-confidence, high-severity findings; report the rest.

Supply chain security

• SBOMs list every component in an artefact, so you can answer “are we affected?” when a new vulnerability is disclosed.
• Pin and verify dependencies, use private registries or proxies, and watch for typosquatted packages.
• Sign artefacts and verify signatures at deployment; generate build provenance so you know how an artefact was produced.
• Harden the pipeline: least-privilege, short-lived credentials, protected branches, reviewed pipeline changes and isolated build runners.

Vulnerability management

Prioritise by real risk, not just severity scores: is the vulnerable code reachable, is the system internet-facing, is there a known exploit in the wild, how sensitive is the data? Set remediation timelines by priority, track them, and automate dependency updates so most fixes are routine pull requests. Reduce false positives by tuning rules, suppressing with documented justification and giving developers context and fix suggestions with each finding.

Culture and metrics

DevSecOps succeeds when developers own security outcomes. Security champions in each team, quick feedback, clear guidance and celebrating fixes help more than gates. Useful metrics include mean time to remediate by severity, percentage of builds with security checks, open critical vulnerabilities over time, secrets caught before merge, and developer satisfaction with security tooling. Threat modelling at design time — what could go wrong, what we'll do about it — catches issues no scanner can. See cloud security interview questions.

A scenario to rehearse

“A critical vulnerability is announced in a widely used library. How do you respond?” Use SBOMs or dependency inventories to find every affected service, check whether the vulnerable function is reachable and the service exposed, prioritise accordingly, ship patched versions through automated dependency updates, add temporary mitigations such as WAF rules where patching takes longer, and verify with rescans. Afterwards, review how long it took and what would make the next one faster.

This scenario tests inventory, prioritisation, automation and communication at once, which is why it appears in so many loops.

Practising

Answer these out loud, in two minutes or less each, and expect a follow-up on every claim. A free AI interview assistant such as CoPilot Interview can run DevSecOps questions as a mock interview built from your résumé and score each answer. Design a secure pipeline on a whiteboard, stage by stage, and justify where each check sits. See also CI/CD interview questions.

Disclosure: CoPilot Interview is our product, so weigh what we say about it accordingly. Everything else on this page applies whichever tool you use, or none.

Frequently asked questions

What questions are asked in a DevSecOps interview?

Shift-left principles, SAST, DAST and SCA, secrets scanning, container and infrastructure-as-code security, SBOMs and supply chain integrity, policy as code, vulnerability prioritisation, pipeline security, threat modelling and metrics.

What is the difference between SAST and DAST?

SAST analyses source code for insecure patterns without running it. DAST tests a running application from the outside to find runtime vulnerabilities.

What is an SBOM?

A software bill of materials: a list of all components and dependencies in a piece of software, used to track vulnerabilities and licences.

How do you reduce false positives in security scanning?

Tune rules, block only on high-confidence high-severity findings, suppress with documented justification, consider reachability and give developers clear fix guidance.