I have 12 years of infrastructure experience, starting in desktop support and hardware repair before moving through data center work, monitoring, asset management, and systems administration. I currently manage Windows and Linux QA servers and have supported US-based clients, O365 environments, and Linux infrastructure. I have not had much production access, which I suspect may be a gap.
I have some experience with Jenkins deployments that pull code from Git, connect to servers over SSH, and run build and deployment scripts. I have also used or studied Terraform, GitHub Actions, SonarQube, New Relic, AWS, Azure, Azure DevOps, Bash, Python, and basic cybersecurity concepts. I am currently learning Kubernetes, but I am struggling to balance it with work and other responsibilities. I can read and modify scripts with assistance, but I am not yet confident writing them from scratch.
I am 38, supporting a family, and currently earning less than I need. I would like to move into DevSecOps without leaving my current job immediately. What should I focus on first, and how can I prove that I am ready for these roles?
4 Answers
You are not starting over at 38. You are adding security and delivery skills to 12 years of infrastructure experience, which is something many junior candidates do not have. Revisit SonarQube, add Trivy and Checkov to a pipeline, review OWASP fundamentals, and become comfortable reading and modifying Bash and Python before worrying about writing everything from scratch. Also, avoid unpaid internships if possible; use your existing client or home-lab work as the basis for a portfolio and negotiate from your real experience. Keep your current job while building evidence, then apply for platform engineering, cloud operations, DevSecOps, or security-focused infrastructure roles.
Build one complete project instead of collecting more technologies. For example, provision infrastructure with Terraform, deploy an application through Jenkins or GitHub Actions, scan the container with Trivy, check the Terraform with Checkov, run SonarQube, and document the decisions and failures. A public repository and a clear write-up showing what a scan found, whether it blocked deployment, and how you fixed the issue will be much stronger in interviews than simply listing tools or certificates.
Do not try to study Kubernetes, Python, Bash, several cloud platforms, and certification material all at once. Pick one goal for six to eight weeks and finish a practical project around it. Kubernetes fundamentals and infrastructure-as-code would be a good starting point, followed by container and IaC security. CKA is operations-focused; once your Kubernetes foundation is solid, CKS is more directly aligned with a DevSecOps path.
I was hoping to attempt CKA soon, but I will make sure I understand the practical work rather than studying only for the exam.
Your tool list is already enough to start moving in that direction. The bigger question is whether you understand the complete service lifecycle: how software is built, tested, secured, deployed, monitored, and repaired when something goes wrong. Your infrastructure background is valuable because you already understand how systems fail and how to operate them. Focus on connecting security practices to the tools you already know rather than trying to learn every new platform.
That makes sense. I am working on a lab project now and will document each fix and security check so I have something concrete to discuss.