I was going to say something similar. So it's a three way marriage, dev + ops + opsec?

Most companies I know can't even find one person who can do dev + ops well. I've only met a few people. Usually there are ops people who can do a little dev and dev people who can do a little ops. I've seen a few companies where it is a productive marriage but most companies I know just throw Docker into the dev environment and call it devops.

Now imagine having all three be the same role?

> DevSecOps is propelling forward-thinking organizations by doing something simple — fostering collaboration of seemingly contradictory teams to align their disparate goals into a singular effort.

This is not how devops works! Dev ops merges the two teams so that everyone is responsible for both. It doesn't just have the two teams "work together"... the two teams have been "working together" since the web was invented. Devops, by most definitions I know, is where developers are responsible for thinking about and dealing with the operations issues rather than having another team.

As a side question, is it opsec or secops? I've always heard the former.

(edit: reply is on the first part, but i might need coffee :) )

I'm not sure the goal is to have someone who is some kind of horizontal fullstack guru in all spheres, from management to hardcore security. Rather, people with those skills should work together, instead of staying in their silos, by automating the friction points between them all and making the process more "parallel"?

100% agree with this. The point is to have one team working together, where the team has all the required dev, ops, and security skills, or access to tools that can augment the team's skills.

Each member of the team does not need to be a superhero, they just need to be jointly responsible.

The question is how your partition your organisation. Classic is something like Development | Testing | Production. DevOps wants to integrate the different department, but you cannot build one huge team of 100 people.

You could partition by product instead Gmail | Search | Maps | etc.

You could do both partitions, which gives you Matrix Management [0]. In the software world this is more commonly known as introducing the role of a product manager in addition to a team manager.

[0] https://en.wikipedia.org/wiki/Matrix_management

Just to clarify, that's how I run it here but I've been told by some fairly respected devops people that it's not really devops. But in general I agree.

Well, part of the idea as I've heard it from "devops experts" is to make ops so automatic and engrained that it becomes a natural part of development.

Obviously a front-end developer wouldn't be worrying about server configuration, but they can write the integration tests and deploy when they are done without involving another team assuming the test coverage is sufficient / code review is done / etc.

That's the utopia at least.

> As a side question, is it opsec or secops?

Secops, definitely. It helps to think of where the term comes from.

OpSec = Operational Security; outside the infosec circles you'd likely hear this term mostly in conjunction with "spy stuff".

SecOps = Security Operations. I.O.W. the practice and theory of maintaining and improving security of a system.

Thank you for clarifying

i agree.

it's my belief based on experience that all 3 - dev, ops, and security are pretty much a giant slow motion trainwreck everywhere except maybe the big 4. and maybe not even all 4.

this industry is doomed from a job function perspective. we keep making our own jobs more complicated and blurring the lines instead of gravitating toward more rigor. the accountants are doing it for us, and they do a shitty job because it's not their actual industry.

i'm in my last pure tech position. it's becoming too much to deal with relative to the money paid, because the expectations of a 24/7 internet are outpacing our ability to deliver with reasonable compensation and quality of life. i don't see it changing. i only see it getting worse, year by year.

You gotta get out of wherever you're at. There are tons of 9-4 dev jobs in the F500 where it's easy to stand above your peers without working too hard. The benefits can be nice too.

you mean the companies that are constantly getting breached? working for a fortune-class company is just a different flavor of the same underlying bullshit, and one that i especially dislike.

also "just don't work that hard, and collect checks" is not really how i operate. good for you though.