How Tridens DevSecOps Ensures Compliance, Security, and Agility

Dev(Sec)Ops
at Tridens
Tomaž Kramberger

Agenda
• Tech Stack
• DevOps Stack
• DevOps Practices & Process
• DevSecOps
• Monitoring & Support
©2025 Tridens d.o.o. All rights reserved. 2

Tech Stack

DevOps Stack

Why DevOps?
• Higher speed and quality of
product releases.
• Faster responsiveness to
customer needs.
• Team can react to change
requests from customers
faster with adding new and
updating existing features.
• The time-to-market and
value-delivery rates increase.

DevOps Practices
• Continuous integration (CI)
• Merge changes back to the main branch as often as possible.
• Developer's changes are validated by creating a build and running automated tests against
the build.
• Continuous delivery (CD)
• Automatically deploys all code changes to a testing environment after the build stage.
• Continuous testing (CT)
• Testing at earlier stages of the release pipeline.
• Testing more often before release.
• Testing everywhere, that is, across environments and devices.
• Continuous monitoring (CM)
• Help monitor software operation, especially performance issues, identify the cause of the
error, and apply appropriate solutions before significant damage to uptime and revenue.
• Infrastructure as code (IaC)

DevOps – CI/CD process

DevOps – GitFlow Strategy
• Production uploads are always made from
Master.
• Master must always be stable and ready to
deploy.
• The work is always done on Develop. Putting
the focus on the product being releasable
and available.
• The Release branch is used to stabilize
development.
• When we develop a feature, it is done on a
Feature branch.
• Feature branches always merge with
Develop.
• Hotfix branch to resolve critical production
issues. In addition, this new branch will be
merged with Master and Develop as soon as
this problem is solved.

DevOps – Cheat Sheet

DevOps – GIT Operations
git commit --allow-empty -m “[<command>]“
Example:
git commit –allow-empty –m “[ci-release]“
git commit –allow-empty –m “[ci-review]“
git commit –allow-empty –m “[ci-run]“
git commit –allow-empty –m “[ci-run|ere:feature/some-feature|tgw:feature/some-feature]“

DevOps – CI Pipeline
.ci/Jenkinsfile
@Library('Tridens-CI’) _
JenkinsPipeline {
javaVersion='11'
buildTargetPrefix='app/'
dockerImageNamespace='monetization'
bddJobTag='monetizationIntegTag'
applicationType=si.tridenstechnology.jenkins.Configuration.ApplicationType.MAVEN
}

DevOps - JIRA Issue & Project Tracking Software
• Project tracking
• Reports
• Issue creation
• Time tracking
• Kanban board

AWS Cloudformation
• Easy to use
• Flexible and declarative
• Customisation through parameters
• Drag-and-drop UI for visualization
• DevOps principle IaC

DevOps – AI Code Review

DevOps - Jenkins

DevOps - CI Pipeline
CI { … }

DevOps - SonarQube

DevOps – End-To-End Tests

DevOps – AI Generated Tests

DevOps – ER Diagram
Image from trickyenough.com

DevOps – OpenAPI & API docs

DevOps - Issue & project tracking

Trivy – security scanner

Zed Attack Proxy – automated pentesting

GoPhish – phishing simulator

AWS – CloudWatch monitoring
• Built-in metrics
• Custom metrics
• Operational view with dashboards
• Alarms (MS Teams, AWS Lambda)

AWS – Performance Insights Monitoring
• Debug performance issues, for example, by identifying queries that are causing high
load.
• Tuning performance by identifying bottlenecks like CPU or I/O throughput.
• Monitor the performance by aggregating the core performance indicators of your
database.
• Analyse Queries, Analyse Bottlenecks

DevOps – Spring Boot Admin

Status and incident communication tool

Alerting

Questions?
Tomaž Kramberger
CTO, CISO
tomaz.kramberger@tridenstechnology.com

How Tridens DevSecOps Ensures Compliance, Security, and Agility

More Related Content

Recently uploaded (20)

Featured (20)

How Tridens DevSecOps Ensures Compliance, Security, and Agility