ISO/IEC Standards in Critical DevSecOps Course
Online 300-hour course in ISO/IEC standards for critical DevSecOps. 6 modules covering IEC 62443-4-1 (secure development lifecycle), ISO/IEC 27034 (application security) and GitLab CI/CD. Assigned tutor and open enrolment.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Explain the principles of secure and continuous development in critical systems.
Apply secure design techniques and security requirements management.
Protect the integration chain and the software supply chain.
Integrate automated security testing into the pipeline.
Generate traceable evidence of compliance.
Plan secure operation and vulnerability response.
Design a DevSecOps pipeline that complies with the applicable standards.
Who it's for
- DevSecOps engineer who wants to specialise in ISO/IEC Standards in Critical DevSecOps.
- Product security manager who wants to specialise in ISO/IEC Standards in Critical DevSecOps.
- Software supply chain engineer who wants to specialise in ISO/IEC Standards in Critical DevSecOps.
- Secure development auditor who wants to specialise in ISO/IEC Standards in Critical DevSecOps.
- Critical software architect who wants to specialise in ISO/IEC Standards in Critical DevSecOps.
- Security test engineer who wants to specialise in ISO/IEC Standards in Critical DevSecOps.
- Engineering or science graduates looking to enter software development.
What you'll work with
- IEC 62443-4-1 (secure development lifecycle)
- ISO/IEC 27034 (application security)
- ISO/IEC 27001 (information security)
- NIST SP 800-218 (Secure Software Development Framework, SSDF)
- ISO/IEC/IEEE 12207 (software lifecycle processes)
- ISO/IEC 5230 (OpenChain, open-source licence compliance)
- Regulation (EU) 2024/2847 (Cyber Resilience Act)
6 modules · 300 h
1.1What continuous integration contributes to a critical system1.2Tension between delivery speed and assurance1.3Secure software lifecycle1.4Applicable secure development standards1.5Functional safety standards and how they fit1.6Sector-specific regulatory requirements1.7Team culture and shared responsibility1.8Domain vocabulary and acronyms1.9Delivery and quality metrics1.10Exercise: diagnosing a team's maturity
2.1System threat modelling2.2Security requirements derived from modelling2.3Traceability between requirement, design and test2.4Principles of least privilege and defence in depth2.5Secrets and credentials management2.6Separation of environments and data2.7Configuration management as code2.8Architecture review and quality gates2.9Living system documentation2.10Practice: threat modelling of a service
3.1Continuous integration and delivery pipeline3.2Static and software composition analysis3.3Software component inventory3.4Dependency management and known vulnerabilities3.5Artefact signing and verifiable provenance3.6Build reproducibility3.7Protection of the repository and pipeline3.8Access control and peer review3.9Pipeline logging and auditing3.10Practice: hardening a build pipeline
4.1Unit, integration and system testing4.2Coverage and its interpretation in critical systems4.3Automated security testing4.4Fuzzing and property-based testing4.5Regression and performance testing4.6Testing on target hardware4.7Qualification of pipeline tools4.8Automatic evidence generation for the certifier4.9Deviation and open issue management4.10Practice: designing the test strategy for a change
5.1Controlled and reversible deployment5.2Observability and logging in operation5.3Patch management in certified systems5.4Impact analysis of a change on certification5.5Vulnerability management and coordinated disclosure5.6Incident response and post-mortem5.7Knowledge management and on-call duty5.8Audit and inspection preparation5.9Continuous process improvement5.10Practice: impact analysis of a patch
6.1Choice of system and its regulatory framework6.2Threat modelling and security requirements6.3Design of the build pipeline6.4Analysis, testing and coverage plan6.5Dependency management and component inventory6.6Evidence strategy for certification6.7Operation, patching and response plan6.8Process indicators6.9Technical report6.10Defence of the work
How you'll learn
100% online training on the SEIUM campus, with downloadable material, recorded lectures and an assigned technical tutor. No fixed timetable: students progress at their own pace within the intake, which allows them to combine it with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is GitLab CI/CD, SonarQube, Trivy, OWASP Dependency-Check, Jenkins, in free, academic or evaluation versions. Tests are studied using real laboratory procedures for secure CI/CD pipelines, dependency and SBOM analysis, and audits of compliance evidence. Assessment is continuous by module plus the final capstone project.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Explain the principles of secure and continuous development in critical systems.
Apply secure design techniques and security requirements management.
Protect the integration chain and the software supply chain.
Integrate automated security testing into the pipeline.
Generate traceable evidence of compliance.
Where this takes you
Requirements
- No previous degree required.
- Internet connection and a computer capable of running the programme's software.
- Spanish-language proficiency sufficient to follow technical standards documentation.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme comprises 300 hours in total, spread over 3 to 5 months. That is between 10 and 15 hours per week on average, compatible with a full-time job.
You will work with GitLab CI/CD, SonarQube, Trivy, OWASP Dependency-Check, Jenkins. Free, academic or evaluation versions are used, and the tutor indicates the open alternative where one exists.
A SEIUM Institute diploma on passing the continuous assessment and the capstone project. It is in-house training, not an official Ministry qualification.
Yes. Modules completed in a course or Postgraduate Diploma in the same area are recognised towards the higher-level programme. Check the recognition policy when you enrol.
Related programmes
Safety Standards in Defence Plants Course
Online 300 h course in safety standards in defence plants. 6 modules covering Law 31/1995 on Occupational Risk Prevention, Royal Decree 130/2017 (Explosives Regulation) and Sphera…
Course in ISO Certification of Armoured Vehicles
Online 300 h course in ISO certification of armoured vehicles. 6 modules covering VPAM BRV 2009 (civil armoured vehicles), EN 1063 (bullet-resistant safety glass) and SolidWorks.…
Course in Ethics in AI for Cyber Defence
Online course of 300 hours in AI ethics for cyber defence. 6 modules covering AI in cyber defence, international law and cyber operations, risks of defensive…
More in Defense, Military Engineering & Land Systems
All Defense, Military Engineering & Land Systems programmes → · How to apply · Fees & financing · Scholarships