What does it mean to "shift security left", and how would you build security into a CI/CD pipeline?
What they are really testing: Whether you know the concrete DevSecOps controls and where each fits, and that you can balance gating against developer friction. This is the heart of the DevSecOps role.
A real interview question
What does it mean to "shift security left", and how would you build security into a CI/CD pipeline?
What most people say
drag me
“I would add a security scanning tool to the pipeline that checks the code before deploying.”
Vague and single-tool. There is no one scanner; the answer should name the distinct layers (SAST, SCA, secrets, image, IaC, DAST) and address gating versus developer friction.
The follow-ups they ask next
What is the difference between SAST, DAST, and SCA?
SAST analyzes your source code statically; DAST tests the running application from outside; SCA inspects your third-party dependencies for known vulnerabilities. They are complementary, not substitutes.
How do you keep security scanning from becoming noise developers ignore?
Tune severity gates, suppress/triage false positives, fail only on actionable high/critical findings, and give clear remediation. A noisy gate gets bypassed; a precise one gets trusted.
What the interviewer is listening for
- Names SAST/SCA/secret/image/IaC/DAST and where each fits
- Knows shift-left = cheaper-earlier
- Balances gating vs developer friction
What sinks the answer
- "Add a scanner" with no layers
- Confuses SAST/DAST/SCA
- Gates on everything with no triage
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“Shift left means [catch issues at commit/build where they are cheap, not in prod]. Layers: [SAST for code, SCA for dependencies, secret scanning, image scanning, IaC scanning, DAST on the running app], plus [signing/SBOM for provenance]. The judgment is [gate on critical/high but tune false positives, or developers route around it].”
Keep going with security
Foundation
Explain the shared responsibility model. Where does the cloud provider's job end and yours begin?
Foundation
What is the CIA triad, and why is it a useful way to think about security?
Foundation
What is the difference between authentication and authorization?
Junior
What is the difference between encryption at rest and in transit, and why do you need both?
Junior
How should an application running in the cloud get credentials to call other cloud services? Why avoid long-lived access keys?
Junior
What is the difference between symmetric and asymmetric encryption, and where is each used?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free