Career roadmap
DevOps Engineer
Automate the path from commit to production, and make that path boring, repeatable and reversible.
Before you start DevOps
- Linux command line: files, processes, permissions, networking basics
- One scripting language: Bash plus Python or Go
- Git beyond commit and push
Linux, networking and Git
Everything above this stage assumes you can debug a Linux box and read a network trace.
The interview will hand you a box that is misbehaving and watch how you investigate.
- Processes, signals and systemd units
- File permissions, users and sudo policy
- Disk, inodes, and filesystem troubleshooting
- top, ps, lsof, strace, journalctl
Most production outages are DNS, TLS, or a firewall rule. Know all three cold.
- TCP/IP, subnets, routing and NAT
- DNS resolution and record types
- TLS handshake and certificate chains
- tcpdump, dig, curl -v, ss
Automation starts as a shell script. Write ones that fail loudly and safely.
- Bash: set -euo pipefail, traps, arguments
- Text processing: awk, sed, jq
- Python for anything over fifty lines
- Idempotency in scripts
You will own the branching model, and be asked to defend it.
- Rebase vs merge and history hygiene
- Trunk-based development vs GitFlow
- Tags, releases and semantic versioning
- Monorepo vs polyrepo trade-offs
Namespaces and cgroups, not just docker run. The internals get asked at senior level.
- Images, layers and the build cache
- Multi-stage builds and minimal base images
- Namespaces, cgroups and container isolation
- Registries, tagging and image scanning
BuildProvision a VM by hand, run a service on it behind nginx with TLS, and write the runbook.
Infrastructure as code
If it was clicked in a console, it does not exist. Everything is code, reviewed and versioned.
The default answer for provisioning. State management is where teams get hurt.
- Providers, resources and data sources
- State, remote backends and locking
- Modules, composition and versioning
- Plan review, drift and import
Ansible remains everywhere, especially in enterprises with long-lived servers.
- Ansible playbooks, roles and inventories
- Idempotent tasks and check mode
- Secrets with Ansible Vault
- Immutable infrastructure as the alternative
Depth in one beats shallow familiarity with three. AWS is the safest first choice.
- IAM, roles and least privilege
- VPC, subnets, security groups
- Compute, storage and managed databases
- Cost model and billing alerts
Baking images shifts work from boot time to build time and makes rollout predictable.
- Packer and image pipelines
- Base image patching cadence
- Artefact repositories
- Supply chain provenance
Where credentials live is a question in every DevOps interview and every audit.
- Vault or cloud secret manager
- Dynamic credentials and short TTLs
- Secret rotation without downtime
- Preventing secrets in git history
BuildStand up a full environment from an empty cloud account using only committed code, then destroy and recreate it.
CI/CD pipelines
Commit to production, automatically, with tests and a way back.
Fast, trustworthy builds. A slow pipeline is a pipeline people route around.
- GitHub Actions / GitLab CI pipeline design
- Caching, parallelism and build time
- Matrix builds and reusable workflows
- Flaky test quarantine
Blue/green, canary and rollback — the vocabulary of every deployment discussion.
- Rolling, blue/green, canary
- Feature flags decoupling deploy from release
- Database migrations with zero downtime
- Automated rollback triggers
Argo CD and Flux made the cluster state a pull request. Now the standard for Kubernetes.
- Declarative desired state in git
- Argo CD or Flux reconciliation
- Environment promotion patterns
- Drift detection and self-healing
Supply chain attacks moved this from optional to audited.
- SAST, dependency and container scanning
- SBOM generation and provenance
- Signing artefacts with Sigstore
- Least-privilege CI credentials (OIDC)
Infrastructure code needs tests too, and few candidates can describe how.
- terraform validate and plan review
- Policy as code with OPA / Conftest
- Ephemeral environments per pull request
- Smoke tests after deploy
BuildA pipeline that builds, tests, scans, deploys to staging, and promotes to production on approval.
Kubernetes and runtime
The default deployment target. Debugging it under pressure is the interview.
Pods, deployments, services — and the reconciliation loop that ties them together.
- Pods, ReplicaSets, Deployments, StatefulSets
- Services, Ingress and DNS
- ConfigMaps, Secrets and volumes
- The control plane and reconciliation
Scheduling, resources and eviction — the causes of most cluster incidents.
- Requests, limits and QoS classes
- Node pressure, eviction and OOMKilled
- Affinity, taints and tolerations
- Horizontal and vertical autoscaling
Helm or Kustomize, and a clear view of when templating has gone too far.
- Helm charts, values and releases
- Kustomize overlays
- Chart testing and versioning
- Managing environment differences
Network policy and RBAC are the two things auditors always ask about.
- CNI, service mesh basics
- NetworkPolicy and default-deny
- RBAC, service accounts and workload identity
- Pod security standards
'The pod is CrashLoopBackOff, what do you do' is the single most common question.
- CrashLoopBackOff, ImagePullBackOff, Pending
- kubectl describe, logs, events, exec
- Ephemeral debug containers
- Reading the scheduler's decisions
BuildRun a multi-service app on Kubernetes with autoscaling, ingress, secrets, and a documented failure drill.
Observability, on-call and interviews
Owning production means knowing when it breaks and proving you fixed it.
Prometheus and Grafana are close to universal. PromQL literacy is expected.
- Prometheus scraping and PromQL
- RED and USE method dashboards
- Cardinality and cost control
- Recording rules and long-term storage
Correlating a trace, a log line and a metric spike is the practical skill.
- Centralised logging and retention policy
- Structured logs and correlation ids
- OpenTelemetry tracing
- Sampling strategy and cost
Alert fatigue is the failure mode. Interviewers ask how you would reduce it.
- Alert on symptoms, not causes
- SLOs and error budgets as alert policy
- Escalation, rotation and handover
- Runbooks that are actually used
A structured incident story is the strongest answer in a DevOps behavioural round.
- Incident command and roles
- Mitigate first, diagnose second
- Blameless postmortems
- Action items that actually get done
Expect a scenario round, a live troubleshooting round, and IaC code review.
- Design a CI/CD pipeline out loud
- Debug a broken deployment live
- Review Terraform for security issues
- Explain a real incident you handled
BuildA monitoring stack with dashboards, meaningful alerts, and a written postmortem for a drill you ran deliberately.
DevOps tools on your CV
- Linux
- Docker
- Kubernetes
- Terraform
- Ansible
- GitHub Actions
- Argo CD
- Prometheus
- Grafana
What DevOps employers ask to see
- A repo that builds an entire environment from an empty cloud account
- A pipeline with scanning, staged promotion and automated rollback
- A postmortem from a failure drill you ran on purpose
- A Kubernetes debugging write-up with the actual commands used
Named in every in-demand list for the last decade and still short of supply. Every company that ships software needs it, and the skills transfer cleanly into SRE, platform and cloud architecture.
Content last reviewed 2026-08-31. Guidance only — no institute or paid placement is endorsed anywhere in this book.