DJ Schleen — DevOps: The Sec is Silent

What changes when security becomes part of delivering software instead of a separate gate? DJ Schleen joins Chris and Robert to explain why he prefers DevOps with a silent Sec, drawing on his journey from early programming and hacking to building delivery pipelines. They discuss the difference between genuine transformation and automating an existing process, why governance and compliance belong in the conversation, and how teams can grow their capabilities without adopting every tool at once. DJ walks through his DevSecOps reference architecture as an assembly line from idea to customer value. The conversation closes with learning Kubernetes through K3s, the tradeoffs of managed platforms, and the security thinking that matters more than a particular product.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with DJ Schleen:
→ LinkedIn
→ GitHub

Mentioned in this episode:
→ DevSecOps reference architecture
→ K3s
→ DevOpsDays
→ The Unicorn Project

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
02:12 DJ's programming and hacking roots
06:33 What DevOps is trying to accomplish
09:44 Adoption beyond automating the old process
12:20 Will DevOps become ordinary software delivery?
15:15 Bringing compliance and governance along
18:17 Observers, stakeholders, and participants
19:48 Growing the team with the work
20:34 Why the Sec is silent
24:43 The DevSecOps reference architecture
28:54 Starting small and adding capabilities
31:23 Learning Kubernetes with K3s
33:49 Managed platforms and security tradeoffs
35:53 Closing thoughts