Pedagogical proposal based on DevSecOps to strengthen secure development competencies in software engineering students
DOI:
https://doi.org/10.46480/esj.11.1.317Keywords:
devsecops, software security, competencies, pedagogical proposal, software engineeringAbstract
Context: The growing complexity of software development requires professionals who can incorporate security from the earliest stages of the software lifecycle. In this context, DevSecOps integrates development, security, and operations through collaborative and automated practices. The objective of this study was to design a pedagogical proposal to integrate DevSecOps into the education of software engineering students. Method: The methodology was based on a qualitative study with descriptive and propositional scope, supported by a documentary review of recent literature on secure development, continuous integration, automation, and DevSecOps education. Results: As a result, a proposal structured into four training units was designed, including competencies, learning outcomes, practical activities, technological resources, and assessment strategies aligned with active and project-based learning methodologies. The proposal promotes the transversal incorporation of security throughout the software development lifecycle and constitutes a curricular reference for university software engineering programs. Conclusions: It is concluded that the designed pedagogical proposal has the potential to strengthen competencies related to secure development, automation, and collaborative culture, contributing to more relevant education in response to current industry demands.
Downloads
References
ACM. (2014). Software Engineering 2014: Curriculum guidelines for undergraduate degree programs in software engineering. https://www.acm.org/binaries/content/assets/education/se2014.pdf
ACM. (2020). Computing curricula 2020. https://www.acm.org/binaries/content/assets/education/curricula-recommendations/cc2020.pdf
ASEE PEER. (2024). Implementation of a project-based learning approach in an upper level course in engineering technology. https://peer.asee.org/implementation-of-a-project-based-learning-approach-in-an-upper-level-course-in-engineering-technology
AWS. (2026, June 17). What is DevSecOps? Developer security operations explained. https://aws.amazon.com/what-is/devsecops/
Delphi Technique. (2006). Establishing the Delphi technique as a method for content validity in concept elaboration studies. https://files.eric.ed.gov/fulltext/ED492146.pdf
DevOps.com. (2024, August 13). DevSecOps: Integrating security into the DevOps lifecycle. https://devops.com/devsecops-integrating-security-into-the-devops-lifecycle/
EC-Council. (2026, January 27). DevSecOps for proactive cybersecurity: Best practices. https://www.eccouncil.org/cybersecurity-exchange/devsecops/embracing-devsecops-for-proactive-cybersecurity/
Fernandes, M., Ferino, S., Fernandes, A., Kulesza, U., Aranha, E., & Treude, C. (2022). DevOps education: An interview study of challenges and recommendations. In Proceedings of the ACM/IEEE 44th International Conference on Software Engineering: Software Engineering Education and Training (ICSE-SEET '22) (pp. 90–101). Association for Computing Machinery. https://doi.org/10.1145/3510456.3514152 DOI: https://doi.org/10.1145/3510456.3514152
IBM. (2021, October 5). What is DevSecOps? https://www.ibm.com/think/topics/devsecops
Infosec Institute. (2023, July 13). DevSecOps learning path. https://www.infosecinstitute.com/skills/learning-paths/devsecops
Linux Foundation. (2026, May 5). Implementing DevSecOps (LFS262). https://training.linuxfoundation.org/training/implementing-devsecops-lfs262/
Microsoft. (2024). What is DevSecOps? https://www.microsoft.com/en-us/security/business/security-101/what-is-devsecops
Open Source Security Foundation. (2024a, March 17). OpenSSF releases plan for improving software developer security education. https://openssf.org/blog/2024/03/18/openssf-releases-plan-for-improving-software-developer-security-education/
Open Source Security Foundation. (2024b). Plan for improving software developer security education. https://openssf.org/resources/publications/plan-for-improving-software-developer-security-education/
Open Source Security Foundation. (2024c, July 16). Secure software development education 2024 survey: Understanding current needs. https://openssf.org/press-release/2024/07/17/the-linux-foundation-and-openssf-release-report-on-the-state-of-education-in-secure-software-development/
Open Source Security Foundation. (2024d). OpenSSF education. https://openssf.org/training/
Open Source Security Foundation. (2024e, October 28). OpenSSF expands secure development course with interactive labs. https://openssf.org/press-release/2024/10/29/openssf-expands-secure-development-course-with-interactive-labs/
Ramírez de Dampierre, M., Gaya-López, M. C., & Lara-Bercial, P. J. (2024). Evaluation of the implementation of project-based-learning in engineering programs: A review of the literature. Education Sciences, 14(10), 1107. https://doi.org/10.3390/educsci14101107 DOI: https://doi.org/10.3390/educsci14101107
SII. (2026, January 26). DevSecOps in practice: Integrating security throughout the development lifecycle. https://sii.pl/en/news-feed/devsecops-in-practice-integrating-security-throughout-the-development-lifecycle/
Sudarsan, S., Mittal, A., & Sekar, A. (2025). Curricular integration of DevSecOps: A real-world pipeline approach to secure software engineering education. ACM SIGCITE 2025. https://dl.acm.org/doi/10.1145/3769694.3771132 DOI: https://doi.org/10.1145/3769694.3771132
Published
Issue
Section
License
Copyright (c) 2026 Sandra-Jackeline Soledispa-Pereira, José-Daniel Veloz-Salcedo, Viviana-Katiuska García-Macías, Junior-José Zamora-Mendoza, Oscar-Ivan Briones-Maldonado (Author)
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
Authors retain the copyright of their articles and are therefore free to share, copy, distribute, perform, and publicly communicate their work on their personal websites or in institutional repositories after its publication in this journal, provided that full bibliographic information is given to acknowledge its original publication.
How to Cite
