By By David Ramel08/14/2026
Publication Date: 2026-08-14 00:00:00
DevSecOps Expert: Use ‘Stages, Not Gates’ to Secure Fast-Moving Pipelines
Modern software delivery pipelines can move code from a developer’s workstation toward production quickly, while pulling in third-party libraries, container images, infrastructure code and cloud services along the way. That speed creates a scaling problem for security practices built around manual review near the end of the process.
At today’s online Best Practices for Modern DevSecOps Summit hosted by Virtualization & Cloud Review, Carlos Rivas, an AWS-Certified DevOps Professional, cloud consultant, software developer and AWS instructor, presented an alternative: make security part of the normal delivery pipeline instead of a checkpoint that developers encounter just before release.
His session, “Shift Left, Secure Right: Embedding Security from Code to Cloud,” followed software through four broad phases — code, build, deploy and run — with different security controls applied throughout. Rivas used Amazon Web Services (AWS) and GitHub examples from his own work, while noting that the overall approach also applies to other cloud platforms and traditional datacenter environments.
“So everything is a lot cheaper to fix as early as possible in your deployment pipeline.”
Carlos Rivas,…
