Breaking the Cycle: From Red Teaming to DevSecOps Leadership

0:00SPEAKER_01:All right, welcome back to the deep dive. It is uh Thursday, January 22nd, 2026.

0:05SPEAKER_00:Aaron Powell Good to be here.

0:06SPEAKER_01:You know, I was looking at the tech headlines this morning. And I don't know, something just clicked.

0:11SPEAKER_00:Oh, yeah.

0:12SPEAKER_01:We spend so much of our time talking about the shiny new things. The AI agents, you know, the quantum leaps, the hardware. Sure. But we rarely talk about the uh the invisible scaffolding that's holding it all up. Aaron Powell The plumbing. The plumbing, exactly. And specifically the people who make sure that plumbing doesn't, you know, explode.

0:31SPEAKER_00:Right.

0:32SPEAKER_01:We're talking about security today.

0:33SPEAKER_00:Yeah.

0:34SPEAKER_01:But I want to be really clear, this isn't about the stereotypical hacker in a hoodie.

0:39SPEAKER_00:No, no. That movie trope is uh thankfully pretty dead in 2026. Trevor Burrus, Jr.

0:43SPEAKER_01:We're looking at something I think much more systemic, a huge shift in how we build software and how security has had to just sprint to keep from being a bottleneck.

0:53SPEAKER_00:And to do that, we're digging into a really fascinating case study.

0:56SPEAKER_01:Yeah. From Aditya Patty. It's about a career pivot that I think is going to resonate with a lot of people, even outside of tech.

1:02SPEAKER_00:It's the story of Hiroshi Tanaka. And honestly, it's a survival story.

1:07SPEAKER_01:It really is. We're also going to bring in some fresh data on certification trends we're seeing right now, January 2026, especially around AI and supply chain security. But let's start with Hiroshi, because on paper, this guy was already a huge success, right?

1:23SPEAKER_00:No, absolutely. This isn't some junior dev. The source material paints him as a heavyweight.

1:27SPEAKER_01:Right.

1:28SPEAKER_00:He's a senior security consultant, Fortune 500 tech company in Japan. He's got 15 years of experience. His whole resume is just stacked with offensive security.

1:38SPEAKER_01:Aaron Ross Powell Offensive Security? Yeah. We should probably define that. We're talking about the red team.

1:42SPEAKER_00:Correct. The red team. So in security, they play the role of the adversary. They're the professional bad guys.

1:47SPEAKER_01:They get hired to break things.

1:49SPEAKER_00:Exactly. For 15 years, Hiroshi's entire job was to find the cracks in the fortress, get inside, and leave a note saying, I was here, here's how I did it.

1:59SPEAKER_01:Which I have to admit sounds like the coolest job in the world. It's that puzzle-solving thing.

2:03SPEAKER_00:Aaron Powell It is a cool job. It appeals to that breaker mindset. But here's the problem he ran into, and it's really the core of our deep dive today.

2:10SPEAKER_01:Okay.

2:11SPEAKER_00:He was excellent at breaking things, but the way the company built things completely changed from under him.

2:16SPEAKER_01:And this is the shift to DevOps and uh cloud native development.

2:21SPEAKER_00:Precisely. You know, think of the old way of making software, the waterfall method.

2:26SPEAKER_01:Right.

2:26SPEAKER_00:You design it, you build it, you test it, and then right at the very end, you toss it over the wall to Hiroshi. He hacks at it for two weeks, finds 10 flaws, and throws it back.

2:36SPEAKER_01:But nobody waits until the end anymore. That feels so archaic.

2:39SPEAKER_00:No. We deploy continuously now. Companies like his are pushing updates, I mean, hourly, sometimes minutes apart. You just can't have a two-week security audit for a code change that took 20 minutes to write.

2:50SPEAKER_01:It just jams up the whole system.

2:52SPEAKER_00:Completely.

2:52SPEAKER_01:And the text really zeroes in on Hiroshi's anxiety about this. It wasn't just that the process was different. His expertise was suddenly, well, wrong.

3:02SPEAKER_00:Yeah, there's that quote where he says, I could find vulnerabilities in production, but I had no idea how to prevent them during development.

3:10SPEAKER_01:That's the breaker hitting a wall. Developers started asking him questions like, uh, hey, how do we secure this CICD pipeline? Or how do we automate scanning?

3:21SPEAKER_00:And he didn't have the answers. He knew how to pick the lock, but he had no clue how to design a better lock.

3:27SPEAKER_01:That has to be a terrifying place to be for a senior expert.

3:31SPEAKER_00:Yeah.

3:31SPEAKER_01:The go-to guy for 15 years, and suddenly everyone's speaking a different language.

3:36SPEAKER_00:The source says he was afraid of becoming irrelevant. Not just that he wouldn't get promoted, he was worried he couldn't even keep his job.

3:43SPEAKER_01:It's that classic adapter-die moment. The industry moved from what, security assurance to security engineering.

3:50SPEAKER_00:From checking it later to building it safe from the start. And he knew if he didn't make that leap, he'd be left behind.

3:56SPEAKER_01:So he needs a fix and fast. He's not going back for a four-year degree.

4:01SPEAKER_00:No way.

4:01SPEAKER_01:The case study says he did a 60-day sprint.

4:04SPEAKER_00:Right. He enrolled in a program, the certified DevSecOps Professional, or CDP, and that term DevSecOps, it's really about smashing together development, security, and operations into one thing.

4:17SPEAKER_01:60 days is an aggressive timeline. And looking at the course description, this wasn't just, you know, watching some videos.

4:23SPEAKER_00:No, and that's the key. The source makes a point to mention 100 plus hands-on labs. You can't just learn this stuff conceptually. You have to get your hands dirty.

4:31SPEAKER_01:It's the difference between reading about riding a bike and actually riding one.

4:35SPEAKER_00:Exactly.

4:36SPEAKER_01:Okay, so let's get our hands dirty. The course description has this. I can only call it an alphabet soup of acronyms he had to master.

4:43SPEAKER_00:Ah, yes.

4:44SPEAKER_01:And I want to walk through them because they're not just buzzwords. This is the actual machinery of modern software.

4:48SPEAKER_00:Let's do it.

4:49SPEAKER_01:First up, CICD. We threw the term around, but what does it actually look like? Jenkins, GitLab CI, GitHub Actions.

4:58SPEAKER_00:So CICD is continuous integration and continuous deployment. Imagine that Car Factory assembly line. A developer writes some code, hits save, a robot arm, the CI system, instantly picks it up, builds the app, runs tests.

5:13SPEAKER_01:And if it passes, it just goes live.

5:15SPEAKER_00:It pushes to the cloud. And here's where Hiroshi's new job comes in. He's not the quality inspector at the end of the line anymore.

5:22SPEAKER_01:So where is he?

5:23SPEAKER_00:He's installing sensors on the conveyor belt. He's now part of the machine. He literally writes code that sits inside that pipeline. So if a developer tries to submit code with, say, a password in plain text, Hiroshi's sensor trips, the whole line stops, and the developer gets an instant alert.

5:40SPEAKER_01:Aaron Powell So the bad code physically cannot get to the end.

5:43SPEAKER_00:It can't. No human intervention needed.

5:45SPEAKER_01:Okay. Next one. SCA, software component analysis.

5:49SPEAKER_00:This is huge. Modern software isn't written from scratch. It's assembled, like with Legos, from open source libraries.

5:56SPEAKER_01:Right. You might write 10% of the code yourself and pull the other 90% from the internet.

6:00SPEAKER_00:Aaron Powell, which sounds great until you import a broken Lego or a poisonous one. SCA is like it's like checking the ingredients list on your food. It automatically scans all those imported libraries for known vulnerabilities. Remember the whole log4j mess?

6:17SPEAKER_01:Oh yeah. Hard to forget that one.

6:19SPEAKER_00:That was a flaw in one tiny free library that basically the entire internet was using. SCA tools are what tell you, hey, you're using the bad version. Update it now.

6:29SPEAKER_01:It's turning security from a bouncer into a health inspector. I like that.

6:33SPEAKER_00:That's a great way to put it.

6:34SPEAKER_01:Okay. Next up, a pair. SAST and DAST. Sounds like a comedy duo.

6:40SPEAKER_00:They work together. SAST is static testing. It looks the source code, the blueprint, when it's just a bunch of text files.

6:47SPEAKER_01:Like proofreading a document for typos.

6:49SPEAKER_00:Exactly. And DAST is dynamic testing. That happens when the app is actually running. It attacks the app from the outside just like a real hacker would trying to break it.

6:57SPEAKER_01:So SAST checks the blueprint, DAS test drives the car.

7:01SPEAKER_00:Perfect analogy. And Hiroshi's job was to automate all of it. Das used to be a guy manually clicking buttons for a week.

7:07SPEAKER_01:Right.

7:07SPEAKER_00:Now it has to be a script that runs in under 10 minutes, or developers will just turn it off.

7:12SPEAKER_01:Okay. This next one feels like the biggest shift. IAC. Infrastructure as code. Terraform, Ansible.

7:21SPEAKER_00:This is the cloud. I mean, this is the cloud paradigm. In 2010, you wanted a server, you bought a metal box.

7:27SPEAKER_01:Plugged it in.

7:28SPEAKER_00:In 2026, you write a script that says, hey AWS, give me a server with these specs. That script is code.

7:35SPEAKER_01:So you're literally building the infrastructure with text files.

7:38SPEAKER_00:Yes. And here's why that's so scary for security. If you make a mistake manually configuring one server, you break one server.

7:45SPEAKER_01:Okay.

7:46SPEAKER_00:If you have a typo in your IAC script and you deploy that to 5,000 servers.

7:50SPEAKER_01:You've just broken the entire company.

7:51SPEAKER_00:Or worse, if that script accidentally says allow traffic from anywhere, you've just opened your entire database to the public internet instantly. Wow. So Hiroshi had to learn to read and secure those scripts. He had to audit the code that builds the firewall, not just configure the firewall itself.

8:07SPEAKER_01:Which means he had to learn to code.

8:09SPEAKER_00:That's the dev and dev secups. You can't secure what you can't read.

8:13SPEAKER_01:Last one.

8:15SPEAKER_00:Ugh. The boring stuff made invisible. Instead of an auditor coming around with a clipboard asking if your data is encrypted.

8:22SPEAKER_01:The system just checks it for you.

8:24SPEAKER_00:It enforces it. You try to deploy a database without encryption enabled, the deployment just fails. The policy is the code.

8:30SPEAKER_01:Okay, so Hiroshi spends two months drinking from this fire hose. He gets the certification. The big question, does it actually work? Is it just a badge for his LinkedIn?

8:42SPEAKER_00:The case study data is pretty clear on this, and the impact was fast. It says within 30 days of certifying, he got his first win.

8:50SPEAKER_01:He led a secure CICD pipeline implementation. But let's get to the numbers. Automated scanning caught 23 high severity vulnerabilities before production.

8:59SPEAKER_00:Okay. Let's just pause on that for a second. 23 high severity bugs.

9:03SPEAKER_01:Yeah.

9:03SPEAKER_00:In the old red team world, Hiroshi might have found those during a penetration test, maybe three, four months later.

9:09SPEAKER_01:After the app was already alive with customer data in it.

9:12SPEAKER_00:Precisamente, after the damage could have been done. And there's a huge economic piece to this too.

9:17SPEAKER_01:The cost to fix things, right?

9:18SPEAKER_00:There's an old rule in software. A bug found in development costs, say a dollar to fix. In testing, it's ten dollars. In production, it's a hundred dollars.

9:26SPEAKER_01:Because in production, you've got downtime, PR crises, data recovery.

9:31SPEAKER_00:All of it. So by catching those 23 bugs early, he didn't just prevent a hack, he saved the company a massive amount of money.

9:38SPEAKER_01:The text also mentions speed. He cut security-related deployment delays from two weeks down to two days.

9:44SPEAKER_00:And that's the metric that gets you a promotion. Security is so often seen as the department of no.

9:50SPEAKER_01:The people who slow everything down.

9:51SPEAKER_00:By cutting that delay, he turned security into a business enabler. He helped them ship faster and safer.

9:57SPEAKER_01:And the market rewarded him for it. Let's talk personal ROI.

10:02SPEAKER_00:It was huge. Promoted to AppSec lead in six months. Now he's training eight junior engineers and the salary.

10:09SPEAKER_01:A 40% increase. That is life-changing.

10:11SPEAKER_00:It's just supply and demand. Lots of people can break things. Very few people can architect a system that prevents things from being broken in the first place. The builders are worth more than the breakers.

10:20SPEAKER_01:There's a quote from him that just perfectly captures this whole thing. He says, I went from being the person who breaks things quarterly to the person embedded in sprint planning.

10:29SPEAKER_00:He stopped being the antagonist and he became a partner.

10:31SPEAKER_01:Yeah, so that's Hiroshi. But let's zoom out. It's January 2026. DevZecOps is kind of the baseline now. But looking at these new course catalogs, the field is already fracturing into these really specific niches.

10:45SPEAKER_00:It really is. The generalist security person is fading. You look at the catalog now and you see things like C A I S P, certified AI security professional.

10:55SPEAKER_01:Let's talk about that. It mentions AI supply chain risks and securing data pipelines. And I see a reference to an article called LLM Attacks.

11:03SPEAKER_00:This is the new frontier. Everyone is plugging in large language models. But you can't just put a firewall around an LLM. Why not? Because the attack vector is language itself. You have things like prompt injection where you trick the AI into ignoring its safety rules, or data poisoning, where you feed the AI bad information during training so it learns the wrong things on purpose.

11:24SPEAKER_01:So you're not securing the server the AI runs on, you're securing the AI's brain. Trevor Burrus, Jr.

11:29SPEAKER_00:And the data that feeds that brain. It's a completely different discipline from network security. Trevor Burrus, Jr.

11:34SPEAKER_01:Then you've got the cloud stuff, a C CNSC for cloud native and a CCSE for containers. Why do you need two different experts?

11:42SPEAKER_00:Aaron Powell So think of a container as the individual shipping crate your app lives in. Securing that is making sure the box is locked. Okay. But Kubernetes, that's what the C CNSE covers. Kubernetes is the entire port. It's the massive system of cranes moving thousands of those crates around every second.

11:59SPEAKER_01:Ah, so you can have a secure crate, but if the crane drops it in the ocean.

12:04SPEAKER_00:It doesn't matter. Kubernetes is so complex, if you misconfigure it, you don't just compromise one app, you compromise the entire port. That takes a true specialist.

12:12SPEAKER_01:And lastly, this supply chain expert, the CSSE.

12:16SPEAKER_00:This goes back to our ingredients analogy. We've seen huge attacks where the hackers didn't hit a company directly, they hit one of the company's software suppliers.

12:24SPEAKER_01:Poisoning the water supply instead of breaking down the door.

12:27SPEAKER_00:Exactly. Supply chain security is about vetting every single tool and library that touches your code. It's about building a chain of trust from the developer's keyboard all the way to the customer.

12:39SPEAKER_01:These courses aren't cheap. I'm seeing prices from like$600 to$1,200.

12:43SPEAKER_00:True, but look how they're bundled. They're packaging the CDP Hiroshis course with the Kubernetes one. They know the future is a baseline in DevSecOps plus a deep specialty.

12:54SPEAKER_01:And when you look at Hiroshi's 40% raise, a$1,500 investment looks like a pretty good bet.

13:00SPEAKER_00:It's an arbitrage opportunity. The industry is desperate for people with these skills. And the great thing is, none of this requires a four-year degree. It just requires proving you can do the work in the labs.

13:10SPEAKER_01:The democratization of expertise.

13:12SPEAKER_00:That's it.

13:12SPEAKER_01:I want to finish with what I think is the most profound quote in the whole case study. It's right at the end. Hiroshi says, I don't find as many vulnerabilities anymore because there aren't as many defined. That's the real measure of success.

13:25SPEAKER_00:It's beautiful, isn't it? It just completely flips the entire scoreboard of security.

13:30SPEAKER_01:It does. As a red teamer, your ego is all about how many bugs you find. I found 10. I'm a genius.

13:36SPEAKER_00:Right. But for a DevSecOps engineer, success is silence. Success is a boring report. It means the guardrails you built work so well that the mistakes never happened.

13:47SPEAKER_01:It's a different kind of confidence. You're not the hero who swoops in to save the day at the last minute.

13:52SPEAKER_00:No, you're the quiet architect who made sure the day never needed saving in the first place. You're the reason people get to sleep at night.

13:59SPEAKER_01:And that applies so far beyond just cybersecurity.

14:01SPEAKER_00:Oh, a hundred percent.

14:03SPEAKER_01:So here's the question for you listening today. In your own field, whatever it is, marketing, finance, engineering, are you the breaker? Are you the one who's great at fixing things after they go wrong?

14:14SPEAKER_00:Or are you learning the tools to build them right the first time? Because as we saw with Hiroshi, the world is paying a massive premium for the builders.

14:22SPEAKER_01:Indeed. And if that means learning a little alphabet soup along the way, seems like it's worth the effort.

14:28SPEAKER_00:A little studying, never hurt anyone.

14:30SPEAKER_01:Thanks for diving deep with us today.

14:32SPEAKER_00:A pleasure as always.

14:33SPEAKER_01:We'll catch you on the next deep dive. Stay curious.