Postgraduate Diploma in Release Train, Flags and Security
Online 800-hour Postgraduate Diploma in Release Train, Flags and Security. 8 modules covering NIST SP 800-218, IEC 62443-4-1 and LaunchDarkly. Assigned tutor and open enrolment.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Organise releases using predictable release trains.
Apply feature flags for progressive and safe delivery.
Integrate secure development practices into the delivery cycle.
Protect the supply chain with SBOMs and artefact signing.
Plan secure field updates in line with UNECE R156.
Manage vulnerabilities in accordance with the Cyber Resilience Act.
Govern and improve the release process using metrics.
Who it's for
- Release manager looking to specialise in Release Train, Flags and Security.
- DevSecOps engineer looking to specialise in Release Train, Flags and Security.
- Product security lead looking to specialise in Release Train, Flags and Security.
- Platform engineer looking to specialise in Release Train, Flags and Security.
- Embedded software engineer looking to specialise in Release Train, Flags and Security.
- Vulnerability manager looking to specialise in Release Train, Flags and Security.
- Graduates in engineering or science looking to enter software.
What you'll work with
- NIST SP 800-218
- IEC 62443-4-1
- Reglamento (UE) 2024/2847
- UNECE R155
- UNECE R156
- ISO 24089
- ISO/SAE 21434
8 modules · 800 h
1.1Release cadences and schedules1.2Release train and increment-based planning1.3Semantic versioning and compatibility1.4Release branches and trunk-based development1.5Release criteria and definition of done1.6Managing dependencies between teams1.7Releases for hardware products1.8Version communication and release notes1.9Delivery indicators1.10Case study: release calendar for a connected product
2.1Types of flags: release, experiment and operational2.2Architecture of a flag system2.3Local versus remote evaluation2.4Canary and ring deployments2.5A/B testing and experimentation2.6Kill switches and emergency deactivation2.7Flag technical debt and clean-up2.8Flags in firmware and devices2.9LaunchDarkly and Unleash platforms2.10Practical: progressive deployment with Unleash
3.1NIST SP 800-218 SSDF framework3.2Secure development per IEC 62443-4-13.3Security requirements in the backlog3.4Threat modelling per release3.5Security code reviews3.6SAST, DAST and SCA in the pipeline3.7Secrets management3.8Security training for the team3.9Security gates in release3.10Workshop: security gates in a pipeline
4.1Supply chain attacks4.2SBOMs in SPDX and CycloneDX formats4.3Artefact signing with Sigstore4.4SLSA assurance levels4.5Reproducible builds4.6Managing open-source components4.7Licensing and compliance4.8Provenance verification4.9Secure artefact registry and storage4.10Lab: SBOM and signing with Syft and cosign
5.1Update engineering per ISO 240895.2UNECE R156 software update management system5.3Vehicle cybersecurity per UNECE R1555.4Package signing, encryption and verification5.5Compatibility and dependencies in the field5.6Secure rollback and anti-rollback5.7Post-release monitoring5.8Communication with users and authorities5.9Version records per device5.10Case study: OTA release for a fleet
6.1Vulnerability reception and triage6.2CVSS scoring and prioritisation6.3Security advisories and VEX6.4Coordinated disclosure6.5Emergency patches outside the train6.6Obligations under the Cyber Resilience Act6.7Reporting actively exploited vulnerabilities6.8Support for legacy versions6.9Time-to-fix metrics6.10Practical: security advisory with VEX
7.1Release manager and team roles7.2DORA indicators7.3Change risk management7.4Release process audits7.5Evidence for customers and certifiers7.6Compliance automation7.7Release retrospectives7.8Scaling the process across multiple products7.9DevSecOps maturity7.10Case study: audit of a release process
8.1Product and regulatory context8.2Release train design8.3Feature flag strategy8.4Pipeline security gates8.5SBOM and artefact signing8.6Vulnerability management plan8.7Tracking indicators8.8Implementation plan8.9Report and presentation8.10Final review with the tutor
How you'll learn
100% online training on the SEIUM Institute campus, with downloadable material, recorded classes and an assigned technical tutor. No fixed timetables: students progress at their own pace within the intake, which makes it possible to combine study with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is LaunchDarkly, Unleash, GitLab, Sigstore cosign, Syft, in free, academic or evaluation versions. Tests are studied on real procedures for canary deployment with feature flags, SBOM generation and verification, and an emergency patch simulation. Assessment is continuous per module plus the final integrative project.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Organise releases using predictable release trains.
Apply feature flags for progressive and safe delivery.
Integrate secure development practices into the delivery cycle.
Protect the supply chain with SBOMs and artefact signing.
Plan secure field updates in line with UNECE R156.
Where this takes you
Requirements
- Prior technical training or professional experience in the sector. No university degree is required.
- Internet connection and a computer capable of running the programme's software.
- Sufficient level of Spanish to follow technical standards texts.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 800 hours over 6 to 8 months. That is an average of 10 to 15 hours per week, compatible with a full-time job.
You work with LaunchDarkly, Unleash, GitLab, Sigstore cosign and Syft. Free, academic or evaluation versions are used, and the tutor indicates the free alternative where one exists.
An in-house SEIUM Institute diploma upon passing the continuous assessment and the integrative project. It is in-house training, not an official qualification from the Ministry.
Yes. Modules passed in a course or postgraduate diploma in the same area are recognised towards the advanced programme. Check the credit transfer policy when you enrol.
Related programmes
Diploma in On-Device Runtimes (TFLite/ONNX/TensorRT)
Online postgraduate diploma of 800 hours in On-Device Runtimes (TFLite/ONNX/TensorRT): 8 modules covering on-device inference, LiteRT and TensorFlow Lite, ONNX Runtime, NVIDIA TensorRT on Jetson, alternative…
Postgraduate Diploma in EN 5012x, Rail EMC and Interoperability
Online 800-hour Postgraduate Diploma in EN 5012x, Rail EMC and Interoperability. 8 modules covering EN 50126-1:2017, EN 50129:2018 and IBM DOORS. Assigned tutor and open enrolment.
Diploma in Stackups, Impedance and Routing Rules
Online postgraduate diploma of 800 hours in stackups, impedance and routing rules. 8 modules covering PCB materials and fabrication, stackup design, impedance calculation and control, high-speed…
More in Electronics, Embedded Systems & Telecom
All Electronics, Embedded Systems & Telecom programmes → · How to apply · Fees & financing · Scholarships