How REI built a DevSecOps culture from the start
summary
REI embeds security into platform teams (one engineer spends roughly 50% time inside SRE) and adopts Snyk, SonarQube and OWASP Dependency Checker to find library issues, pairing that with AWS GuardDuty/Security Hub for cloud visibility. A homegrown Crampon framework plus Sherpa deployment standardizes pipelines so teams update shared libraries monthly, SLAs drive mean time to remediation targets, a bug‑bounty and even direct security commits into the monolith force ownership and noticeably speed fixes.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:43Agenda
- 7:09Builders of software and assessors of risk
- 9:35What REI could have improved
- 11:35How did DevSecOps and Cloud Security interact
- 14:04How did you ease the transition for DevSecOps
- 16:27Building trust with DevSecOps
- 18:10The role of the platform team
- 19:57The Alpine team
- 22:25DevSecOps programs
- 24:59Decomposition of monolith
- 28:44Code owners
- 33:16Deprecation policy
- 35:14Metrics
related talks
35mRole of SRE in DevSecOps
33mSecurity and SRE: Natural Force Multipliers
30mIntegrating cloud native security into the SRE culture
49mSite Reliability Engineering and the Security Team They Love
36mThe Road To Being Rugged
39mPragmatic Security for SRE
31mDevSecOps, or How to Integrate Security into DevOps Practices
57mDev-first security: From code to cloud, and back to code (PRT291)