Training course · Claude Code · Security & DevSecOps

Claude Code for Security and DevSecOps Teams

Agentic coding with Claude Code in the terminal and IDE: CLAUDE.md, subagents, hooks, MCP, CI pipelines and secure permissions.

Duration
2 days (14 hrs)
Format
Online or on-site
Language
German or English
Participants
open dates or exclusive for your team
Certificate
Certificate of attendance

Overview

“Claude Code for Security and DevSecOps Teams” is a hands-on course for roles such as Application security engineers and security champions in development teams, DevSecOps and platform engineers responsible for CI/CD pipelines and Penetration testers and red team members. Rather than learning Claude Code in the abstract, you work on tasks from your daily routine – with examples, exercises and templates from Security & DevSecOps.

Claude Code is Anthropic’s agentic coding assistant, working directly in your terminal and in popular IDEs. Rather than completing individual lines, it reads your repository, plans changes across multiple files, runs commands, executes tests and prepares commits. Over two days you will learn to use it with deliberate control: clear project instructions in CLAUDE.md, careful context management, and a workflow in which you set the direction as a developer and can trace every change the agent makes back to a clear intention.

The course is built around real engineering work: diagnosing bugs, delivering features, refactoring legacy code and filling gaps in test coverage. You will configure subagents for specialised tasks, enforce quality checks with hooks, connect external systems through the Model Context Protocol (MCP) and capture team knowledge as reusable skills. Finally, you will run Claude Code headless in CI pipelines and define permissions, sandboxing and approval rules so that its use remains defensible even in security-sensitive environments.

AI coding assistants and agents affect application security from two directions. They speed up threat modelling, code review and detection engineering, yet they also produce new code faster than traditional security gates can absorb. Security and DevSecOps teams therefore use AI to triage SAST findings, propose fixes for vulnerabilities, harden CI/CD pipelines and scan infrastructure as code for misconfigurations. What matters is a controlled setup: agents running with least privilege, no secrets in the prompt context, every change traceable through a pull request and human sign-off on security-critical decisions. In this course you learn to use AI as a force multiplier for your security programme while keeping the new risks of generated code, prompt injection and insecure tool integrations firmly under control.

The course is delivered live – either online in a virtual classroom or on-site in our training rooms in Munich, Salzburg, Berlin, Augsburg, Hanover, Bremen, Stuttgart and Kaiserslautern. We can also run it exclusively for your team.

Who is this course for?

  • Application security engineers and security champions in development teams
  • DevSecOps and platform engineers responsible for CI/CD pipelines
  • Penetration testers and red team members
  • SOC analysts and detection engineers
  • Developers accountable for secure software supply chains

Typical challenges we address

  • A flood of SAST, DAST and SCA findings with a high share of false positives
  • Security review becomes a bottleneck as AI-assisted teams ship far more code
  • Misconfigurations in Terraform, Kubernetes manifests and cloud policies go unnoticed
  • New attack surfaces from LLM integrations, prompt injection and over-privileged agents

What you will be able to do

  • You use Claude Code for multi-step development tasks while keeping full control over every change.
  • You maintain a CLAUDE.md that effectively conveys project conventions, commands and architectural guidance to the agent.
  • You extend Claude Code with subagents, hooks, MCP servers and skills tailored to your team.
  • You integrate Claude Code into Git workflows and CI pipelines with traceable, test-backed results.
  • Use AI agents for triage, review and fix generation without giving up control over security-critical changes.
  • Integrate AI-assisted checks into CI/CD pipelines alongside your existing SAST, SCA and IaC scanners.
  • Assess and mitigate the specific risks of AI-generated code, prompt injection and agent tool access.

Course outline

Day 1

Module 1 How Claude Code works
  • Installation, sign-in and use in the terminal, VS Code and JetBrains IDEs
  • Understanding the agentic loop: read, plan, act, verify
  • Using plan mode to agree on an approach before any code changes
  • Writing effective task briefs with goal, context and acceptance criteria
Module 2 Project context with CLAUDE.md and context management
  • Structuring CLAUDE.md at project, directory and user level
  • Documenting build, test and style conventions so the agent follows them reliably
  • Managing the context window with targeted file references, compaction and fresh sessions
  • Resuming sessions and breaking long tasks into manageable stages
Module 3 Extending Claude Code with subagents, hooks, MCP and skills
  • Defining subagents for code review, research or test generation
  • Using hooks to enforce formatting, linting or checks before and after tool calls
  • Connecting MCP servers for issue trackers, databases or internal documentation
  • Creating custom slash commands and skills for recurring team workflows
Module 4 Git workflows, testing and quality assurance
  • Creating branches, meaningful commits and pull requests with Claude Code
  • Test-first work: have tests written before the implementation
  • Reviewing diffs systematically and rejecting or refining changes
  • Organising parallel work with Git worktrees and multiple sessions

Day 2

Module 5 Headless operation, CI and security
  • Running Claude Code non-interactively in scripts and CI pipelines
  • Automated reviews and issue handling in GitHub or GitLab workflows
  • Configuring permission modes, allow and deny rules, and sandboxing
  • Handling secrets, prompt injection risks and organisation-wide policies
Module 6 Practice lab: Security & DevSecOps
  • Faster threat modelling
  • SAST finding triage
  • Secure code review
  • Hardening IaC and containers
  • Detection engineering
  • Securing the supply chain
Module 7 Data protection, quality & transfer to daily work
  • Source code, vulnerability data and logs are highly sensitive: you learn which data may be shared with AI services, how to keep secrets out of the context and how AI use aligns with NIS2, the Cyber Resilience Act, the GDPR and the EU AI Act.
  • Ground rules for safe AI use in your team
  • Checking results: facts, sources, tests and the four-eyes principle
  • Personal action plan for the next 30 days
  • Open questions, outlook and resources for further learning

Practical scenarios from your field

Faster threat modelling

Derive STRIDE-based threat analyses from architecture descriptions and data flow diagrams, identify trust boundaries and turn countermeasures into testable requirements ready for the backlog. The model is updated rather than rebuilt when the architecture changes.

SAST finding triage

Match static analysis results against real code context, assess reachability and exploitability, dismiss false positives with a documented rationale and prepare minimal fixes for genuine vulnerabilities as pull requests.

Secure code review

Have pull requests checked specifically for injection flaws, broken authorisation, insecure deserialisation and cryptographic mistakes, with references to OWASP categories and a clear explanation for every finding.

Hardening IaC and containers

Analyse Terraform modules, Helm charts and Dockerfiles for over-privileged roles, exposed ports, missing encryption and unsafe base images, then generate hardened versions backed by policy-as-code rules.

Detection engineering

Draft Sigma rules, YARA signatures and SIEM queries from threat descriptions, validate them against test data and enrich documentation with the relevant MITRE ATT&CK techniques.

Securing the supply chain

Evaluate SBOMs, prioritise vulnerable dependencies, analyse upgrade paths including breaking changes and add pipeline steps for signing, provenance attestation and dependency pinning. Each update pull request explains the risk.

Possible hands-on projects

Finding triage bot

A script that ingests SARIF output from the pipeline, deduplicates findings, enriches them with code context and opens prioritised tickets with a suggested fix.

Secret scanning hook

A pre-commit hook with custom patterns for internal token formats, allowlist management and clear guidance on how to rotate a leaked secret.

Threat model generator

A small web app that turns a system description into a structured threat model with data flows, risks and mitigations, exportable as a document.

Prerequisites

You have hands-on programming experience in at least one language and are comfortable with Git and the command line. You have hands-on experience in software development or operations and a working knowledge of application security, such as the OWASP Top 10 and CI/CD pipelines.

Technical requirements

Your own laptop with admin rights, Git, a Node.js runtime and an up-to-date editor; a Claude subscription or Anthropic API access is required for the exercises.

Data protection & compliance

Source code, vulnerability data and logs are highly sensitive: you learn which data may be shared with AI services, how to keep secrets out of the context and how AI use aligns with NIS2, the Cyber Resilience Act, the GDPR and the EU AI Act.

Suggested dates

All dates are suggestions – your preferred date is always possible.

  • Wed, 25 November 2026 – Thu, 26 November 2026 Online Request
  • Tue, 8 December 2026 – Wed, 9 December 2026 Salzburg Request
  • Thu, 17 December 2026 – Fri, 18 December 2026 Online Request
  • Mon, 18 January 2027 – Tue, 19 January 2027 Online Request
  • Tue, 26 January 2027 – Wed, 27 January 2027 Augsburg Request
  • Wed, 3 February 2027 – Thu, 4 February 2027 Online Request

Frequently asked questions

How is Claude Code different from traditional code completion?

Code completion suggests the next few lines, whereas Claude Code acts as an agent that handles whole tasks: it searches the repository, plans changes across several files, runs tests and commands, and corrects itself based on the results. You define the goal and review the outcome instead of steering every single line yourself.

Is Claude Code secure enough for enterprise use?

By default, Claude Code asks for approval before editing files or running commands. Permission rules, sandboxing, managed settings and hooks let you define precisely what the agent may do. During the course you learn to configure these mechanisms to match your security and data protection requirements and to assess risks such as prompt injection.

Does Claude Code work with my language and tech stack?

Yes. Claude Code is language-agnostic because it works with files, terminal commands and your existing build and test tooling. Whether you use Python, Java, TypeScript, Go, SAP-related code or infrastructure as code, what matters most is a well-written CLAUDE.md describing your commands and conventions. Each course variant adds the relevant domain focus.

Is AI-generated code a security risk?

AI assistants sometimes reproduce insecure patterns, outdated libraries or even non-existent package names. The risk is manageable when generated code passes the same gates as hand-written code: peer review, SAST, dependency scanning and tests. In the course you set up exactly these guardrails while using AI yourself to find and fix vulnerabilities faster.

Should an AI agent be allowed to apply security fixes on its own?

We recommend a tiered model: the agent analyses, proposes fixes and opens pull requests, while humans approve the merge. For low-risk routine work such as dependency updates with passing tests, more automation can make sense. You learn to design permissions, sandboxing and audit trails so every decision remains traceable.

How much does “Claude Code for Security and DevSecOps Teams” cost?

The course costs a flat €949 plus VAT per participant – whether online or on-site. This includes 2 training day(s) with a live trainer, course materials, a lab environment and a certificate of attendance.

Can I suggest my own date?

Yes. Our suggested dates are just a guide. In the request form you can always describe your preferred date or period in free text – we check availability and confirm within one working day.

Is the course online or on-site?

Both are possible: live online in a virtual classroom or on-site in Munich, Salzburg, Berlin, Augsburg, Hanover, Bremen, Stuttgart or Kaiserslautern. We can also run the course exclusively for your team.

More courses for Security and DevSecOps Teams

More Claude Code courses

All 77 Claude Code courses

Claude Code · MunichClaude Code · SalzburgClaude Code · BerlinClaude Code · AugsburgClaude Code · HanoverClaude Code · BremenClaude Code · StuttgartClaude Code · KaiserslauternClaude Code · Online