Skip to main content

Episode #075: Security Ops Specialty: The Underrated Skill Every Platform Engineer Needs in 2026

Duration: 19 minutes | Speakers: Jordan & Alex | Target Audience: Platform engineers, SREs, DevOps professionals

đź“° News Segment: This episode covers 3 platform engineering news items before the main topic.

News Segment​

StorySourceWhy It Matters
Kubernetes Agent SandboxKubernetes SIGsOpen-source controller for securely running AI-generated code on K8s using gVisor isolation
Backstage 2025 Year in ReviewBackstage3.4K adopters, 89% IDP market share, 250+ plugins, new frontend system adoption-ready
API Key/Certificate Expiry ManagementRedditOrganizations still tracking credentials manually; highlights need for secrets lifecycle automation

Platform engineers who understand security operations—secrets management, vulnerability scanning, and compliance automation—are commanding premium salaries in 2026. This episode breaks down the security ops specialty: what it includes, why organizations are desperate for it, and how to build these skills alongside your existing platform engineering expertise.

The Five Security Ops Domains​

DomainKey ToolsWhat Platform Engineers Do
Supply Chain SecuritySigstore, Trivy, Grype, SLSASign/verify container images, scan vulnerabilities, generate SBOMs
Secrets ManagementHashiCorp Vault, SOPS, AWS Secrets ManagerDynamic secrets, automatic rotation, audit trails
Runtime SecurityFalco, eBPF, gVisor, seccompDetect anomalies, enforce policies at runtime
Identity & AccessSPIFFE, SPIREWorkload identity, zero-trust networking
Compliance as CodeOPA, Gatekeeper, KyvernoPolicy enforcement, automated compliance

Supply Chain Security Deep Dive​

Sigstore Architecture​

ComponentPurpose
CosignContainer image signing with keyless signatures tied to OIDC identity
RekorTransparency log recording every signature (like Certificate Transparency)
FulcioCertificate authority issuing short-lived certificates (10 min)
Policy ControllerKubernetes admission webhook validating signatures before pod creation

Key insight: No long-lived private keys to manage. Your identity provider (GitHub, Google, corporate OIDC) is the root of trust.

Secrets Management with Vault​

Dynamic Secrets Flow​

  1. Pod authenticates to Vault using Kubernetes service account token
  2. Vault validates token against K8s API
  3. Vault creates temporary database credential (1-hour expiry)
  4. Pod receives credential; Vault logs access with full audit trail
  5. No static credentials exist; rotation is automatic

Platform engineering approach: Secrets as a platform capability—developers request through API/portal, platform provisions short-lived, auto-rotating secrets tied to workload identity.

Runtime Security with eBPF​

How Falco Works​

StepDescription
HookeBPF probes attach to system calls
CaptureEvery file open, network connection, command execution captured with context
ContextProcess hierarchy, container ID, K8s metadata included
EvaluateRules detect anomalies (shell in container, unexpected network, credential access)
AlertSend to Slack, PagerDuty, or trigger K8s response (kill pod)

Example Detection Rule​

Detect shell spawned in container:

  • Watch for execve syscalls where process is bash/sh/zsh
  • Filter where container ID is not host
  • Add exceptions for legitimate debug sidecars

Policy as Code with OPA/Gatekeeper​

How It Works​

  1. Gatekeeper admission controller intercepts K8s resource creation
  2. Sends request to OPA with full object and context
  3. OPA evaluates policies written in Rego
  4. If violation found, Gatekeeper rejects with violation message
  5. Policies stored as K8s CRDs—version-controlled like any config

What you can enforce: Network segmentation, security contexts, resource configs, encryption at rest, access patterns.

Skill Building Path​

PhaseFocusActions
StartSupply Chain SecurityAdd Trivy scanning to CI, implement Sigstore signing, understand SBOMs
FoundationPolicy as CodeWrite OPA policies for admission controllers, learn Rego
IntermediateSecrets ManagementImplement Vault with dynamic secrets, understand PKI/certificate rotation
AdvancedIdentity & AccessDeploy SPIFFE/SPIRE for workload identity
ExpertRuntime SecurityFalco deployment, eBPF programming for observability

Quick Wins for This Week​

  1. Add Trivy scanning to one CI pipeline (~1 hour)
  2. Write one OPA policy for K8s (e.g., require resource limits, disallow privileged containers)
  3. Deploy Falco in audit mode on non-production cluster—observe what it detects

Salary Impact​

Skill CombinationPremium
Platform Engineering aloneBaseline
Platform Engineering + Security Ops10-20% higher

Key insight: Many security engineers lack platform/infrastructure depth. Many platform engineers lack security depth. Bridging that gap is career gold.

Certifications​

CertificationFocus
CKS (Certified Kubernetes Security Specialist)Covers many of these areas in K8s context
HashiCorp Vault AssociateSecrets management fundamentals
SANS Cloud SecurityComprehensive but expensive

Reality check: Hands-on experience matters most. Build a lab, implement these tools, break things, fix them.

Key Takeaways​

  1. Platform is the new perimeter—you're responsible for security posture of everything you provision
  2. Five domains to master: Supply chain, secrets, runtime, identity, compliance as code
  3. Sigstore enables keyless signing—OIDC identity as root of trust
  4. Vault dynamic secrets eliminate static credentials and manual rotation
  5. eBPF/Falco detect threats in real-time at kernel level
  6. OPA/Gatekeeper codify compliance requirements as enforceable policies
  7. Start with Trivy + one OPA policy—quick wins with visible impact

Resources​