A tailored course, built for your situation
Mastering SLSA for Site Reliability Engineers
Build supply chain integrity with confidence and precision
$199 one-time
24-hour access provisioning
30-day money-back guarantee
Hand-built implementation playbook
12 modules. 12 chapters per module. 144 chapters total.
12 modules, each with 12 chapters (144 chapters total), text-based, plus downloadable templates and a hand-built implementation playbook delivered alongside course access.
Struggling to prioritize which security frameworks to deepen?
The situation this course is for
Many SREs are pulled in multiple directions, operational stability, audit readiness, incident response, without a clear path to own proactive security architecture. The result is reactive compliance and missed opportunities to lead.
Who this is for
Senior Site Reliability Engineer working in a high-velocity, cloud-native environment with growing responsibility for software supply chain integrity and platform security.
Who this is not for
This is not for junior engineers looking for introductory security training, nor for leaders seeking board-level talking points. It’s for hands-on practitioners ready to lead implementation.
What you walk away with
- Architect SLSA-compliant pipelines tailored to service-critical workloads
- Evaluate and select tooling with confidence using standardized scoring rubrics
- Produce auditable attestations that reduce review cycles by 50%
- Lead vendor integration decisions with clear, enforceable criteria
- Demonstrate measurable progress from Level 1 to Level 4 SLSA compliance
The 12 modules (with all 144 chapters)
Module 1. SLSA Fundamentals and the Zero Trust Supply Chain
Establish core definitions, threat models, and the evolution from CI/CD security to SLSA-based integrity. Learn how Google, Atlassian, and the U.S. government are applying SLSA to reduce compromise risk in production.
12 chapters in this module
- What SLSA solves that other controls miss
- The four SLSA levels and what they mean
- Mapping SLSA to existing CI/CD pipelines
- Understanding tiered artifact signing
- Provenance and how it closes trust gaps
- When to apply SLSA vs. SBOM alone
- Role of attestations in audit trails
- Key stakeholders in implementation
- Common misconceptions about SLSA
- How open source projects adopt SLSA
- Integrating SLSA into incident response
- Tools that support SLSA natively
Module 2. Designing SLSA Level 1 Compliant Workflows
Implement baseline controls for source integrity, build process logging, and artifact signing. Create templates that scale across teams with minimal overhead.
12 chapters in this module
- Defining source repository controls
- Versioning source code traces
- Build metadata capture
- Basic provenance requirements
- Artifact signing with minified toolchains
- Storing builds in trusted registries
- Automating SLSA Level 1 checks
- Integrating with GitHub Actions
- Using Tekton for audit trails
- Validating with slsa-verifier
- Documentation for auditors
- Common Level 1 gaps
Module 3. Achieving SLSA Level 2 with Isolated Builds
Move beyond logging to isolation and verification. Configure build environments that prevent unauthorized changes and ensure reproducibility.
12 chapters in this module
- Why isolation matters at Level 2
- Containerizing build environments
- Immutable build definitions
- Verified environment toolchains
- Time-bound build windows
- Build reproducibility testing
- Using remote signing services
- Attestations with timestamping
- Cross-team synchronization
- Audit trail completeness
- Tooling choices: Tekton vs. Cloud Build
- Validation automation
Module 4. SLSA Level 3: Reusable and Reproducible Builds
Achieve high confidence in build integrity through full reproducibility and centralized control. Enable platform-wide reuse of trusted templates.
12 chapters in this module
- Defining reproducible build standards
- Container image base hardening
- Deterministic build flags
- Stable dependency resolution
- Persistent build service identity
- Signed build templates
- Golden pipeline pattern
- Cross-project reuse strategies
- Version-controlled build configs
- Testing for drift detection
- Automated rebuild triggers
- Audit readiness at scale
Module 5. SLSA Level 4: Fully Reproducible and Verified Builds
Implement the highest tier with dual independent builds and cryptographic verification. Prepare for regulatory and customer demands.
12 chapters in this module
- Dual build requirement explained
- Geographically distributed builds
- Independent toolchain validation
- Cryptographic rebuild matching
- Threshold signing schemes
- Time-locked attestation windows
- Third-party verification integration
- Customer-facing compliance packages
- Handling rebuild failures
- Automation for continuous verification
- Scaling across product lines
- Roadmap to full production rollout
Module 6. Attestations and Provenance in Practice
Generate, store, and verify machine-readable claims about software origin. Use in-house and open source tooling effectively.
12 chapters in this module
- What belongs in an attestation
- Using in-toto statements
- SLSA provenance format
- Storing attestations in transparency logs
- Verifying against public sources
- Automated policy checks
- Integrating with vulnerability scanners
- Handling expired attestations
- Multi-region attestation strategies
- Attestation lifecycle
- Tooling: Sigstore, Fulcio, Rekor
- Performance at scale
Module 7. Integrating with Existing CI/CD Systems
Adapt Jenkins, GitLab, and GitHub workflows to meet SLSA standards without sacrificing velocity.
12 chapters in this module
- CI/CD security maturity model
- Mapping pipeline stages to SLSA
- Pre-commit security checks
- Build environment hygiene
- Secrets management integration
- Approval gates for promotion
- Parallel testing with attestations
- Failure handling and rollback
- Monitoring SLSA compliance
- Alerting on non-compliant builds
- Versioning pipeline definitions
- Audit trail integration
Module 8. Vendor and Third-Party Software Assurance
Assess vendor compliance using SLSA, demand attestations, and build verification into procurement decisions.
12 chapters in this module
- Why third-party risk is rising
- Requesting SLSA attestations
- Validating vendor-provided data
- Minimum acceptable levels
- Scoring vendor maturity
- Contractual language suggestions
- Building a preferred vendor list
- Onboarding process updates
- Handling non-compliant vendors
- Customer assurance packages
- Cross-industry benchmarks
- Enabling customer verification
Module 9. Auditing and Continuous Compliance
Create living compliance that evolves with the system. Shift from periodic audits to continuous validation.
12 chapters in this module
- Defining continuous audit scope
- Automated evidence collection
- Policy-as-code for SLSA
- Alerting on compliance drift
- Preparing for external audits
- Generating auditor-ready reports
- Evidence retention policies
- Cross-team visibility
- Versioning audit logic
- Reducing auditor follow-ups
- Integrating with risk registers
- Audit cycle optimization
Module 10. Scaling SLSA Across Teams and Products
Drive adoption without mandates. Use templates, tooling, and peer influence to amplify impact.
12 chapters in this module
- Identifying early adopter teams
- Creating standardized templates
- Internal documentation hubs
- Peer review workflows
- Training champions
- Metrics that prove value
- Reducing cognitive load
- Self-service sign-up
- Feedback loops with engineering
- Handling resistance
- Scaling tooling infrastructure
- Governance without gatekeeping
Module 11. SLSA and SBOM: Integrating the Ecosystem
Combine SLSA with Software Bill of Materials for comprehensive software transparency.
12 chapters in this module
- How SBOM complements SLSA
- Generating SBOMs in pipelines
- Signing SBOMs with SLSA
- Vulnerability disclosure coordination
- Verifying dependency provenance
- Linking SBOM to attestations
- Tooling: Syft, Grype, CycloneDX
- Standard formats and interoperability
- Customer-facing transparency
- SBOM for incident response
- Regulatory expectations
- Future of software transparency
Module 12. Leading the Shift to Secure Supply Chains
Position yourself as the go-to practitioner for secure software delivery. Turn expertise into influence.
12 chapters in this module
- Building internal credibility
- Communicating value to leadership
- Writing internal RFPs
- Influencing architecture boards
- Shaping procurement policy
- Presenting at engineering forums
- Mentoring junior engineers
- Contributing to open source
- Sharing metrics responsibly
- Balancing security and velocity
- Defining career growth paths
- Owning the roadmap
How this maps to your situation
- After a security audit revealed gaps in build provenance
- Before onboarding a new vendor requiring SLSA Level 3
- When scaling CI/CD pipelines across global teams
- During planning for ISO 27001 or SOC 2 integration
Before vs. after
Before
Reactive, fragmented efforts to meet compliance demands without clear ownership or repeatable processes.
After
Proactive leadership on supply chain integrity with structured, auditable, and scalable implementation.
What's included with your purchase
- 12 modules with 12 chapters each (144 chapters)
- Downloadable templates and worked examples for every module
- Hand-built implementation playbook delivered alongside course access
- 30-day money-back guarantee
Delivery and format
- Course and learning environment access provisioned within 24 hours of purchase
- Hand-built implementation playbook delivered alongside course access
Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access.
Time investment: Approximately 3 hours per module, designed to fit around production cycles and on-call rotations.
If nothing changes
Without structured SLSA adoption, organizations face increasing audit friction, vendor pushback, and customer distrust, especially in regulated and cloud-native markets.
How this compares to the alternatives
Unlike generic DevSecOps courses, this program delivers exact implementation steps for SLSA levels, with templates and decision frameworks used in actual platform teams at scale.
Frequently asked
Is this course suitable for someone already using SBOMs?
Yes. This course builds on SBOM knowledge and shows how to layer SLSA for stronger assurance and verification.
How is the course structured?
12 modules, each containing 12 chapters (144 chapters total).
Can I apply this in a hybrid cloud environment?
Yes. The course includes examples from multi-cloud and hybrid deployments, with focus on consistent controls.
$199 one-time. Approximately 3 hours per module, designed to fit around production cycles and on-call rotations..
Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.
30-day money-back guarantee·
144 chapters·
Hand-built playbook included·
Account access within 24 hours