Skip to content
SkillPilotNavigate Your Career

DevOps Engineer Roadmap

A structured path from Linux fundamentals through cloud infrastructure, automation, containers, and monitoring to a production-ready DevOps engineering career.

Entry level
$118,895
DevOps Engineer salary estimate (average, US)
Mid level
$174,243
Mid-Level DevOps Engineer salary estimate (average, US)
Senior level
$181,848
Senior DevOps Engineer salary estimate (average, US)
Glassdoor

This path assumes you write some code or scripts and are comfortable in a terminal, but have not yet run cloud infrastructure or production deployments professionally. If you already administer Linux servers, phase one is a two-week refresher rather than two months.

Each phase below lists what to learn, what to build, and how to know you are done. The exit criteria are deliberately checkable — "you can terraform destroy your environment and recreate it" is verifiable in a way that "you understand Terraform" is not. Work through them in order: each phase assumes the one before it.

Expect 15–21 months alongside a job. Phase three is where most people slow down, because infrastructure as code is the first point where you have to hold a whole system in your head.

New to Linux and the command line?

This path assumes fundamentals you may not have yet. Our Foundations Pack is out and free — Linux, the shell and Git, with exercises that mark your work and explain why you got it wrong. We're writing an agents pack next; leave your email if you want to hear when it ships.

One email when the pack launches. No spam, unsubscribe any time.

Your progress0%

The path, phase by phase

  1. Foundation & Linux Mastery

    Linux administration, the shell, and Git. Done when you can rebuild your server from your own notes without searching, and read someone else's bash script and predict what it does before running it. Kubernetes troubleshooting is Linux troubleshooting: skip this and every later phase becomes guesswork.

    1-2 months
    9 Skills
    Linux Administration
    Filesystem & Permissions
    Process & Service Management
    Bash Scripting
    Text Processing (grep, sed, awk)
    Git & GitHub
    SSH & Key Management
    Networking Basics (DNS, TCP/IP, ports)
    Package Management
    Show details, projects and resources

    Skills you'll master

    Linux Administrationintermediate
    Filesystem & Permissionsintermediate
    Process & Service Managementintermediate
    Bash Scriptingintermediate
    Text Processing (grep, sed, awk)intermediate
    Git & GitHubintermediate
    SSH & Key Managementintermediate
    Networking Basics (DNS, TCP/IP, ports)beginner
    Package Managementbeginner

    Hands-on projects

    1. 01Set up a Linux server from scratch, harden SSH access with key-based auth, disable password login, and document every configuration change in a README you could hand to someone else
    2. 02Write a bash script that backs up a directory to a remote host on a nightly cron schedule, rotates old backups, and reports success or failure — including what happens when the remote host is unreachable
    3. 03Build a Git branching workflow for a 3-person team, including pull request templates, a protected main branch, and a documented procedure for reverting a bad merge
    4. 04Diagnose a deliberately broken service — wrong permissions, a full disk, a port already bound — using only journalctl, systemctl and standard tooling, and write up what the symptom looked like versus what the cause was
    5. 05Write a script that audits a server and reports drift from a known-good baseline: unexpected open ports, users with shell access, world-writable files

  2. Cloud Infrastructure & Platforms

    Build cloud infrastructure by hand before automating it. Done when you can explain why a resource in a private subnet cannot reach the internet, fix it without a guide, and draw your VPC from memory. Pick one provider and go deep — three shallow is worth less than one deep, and the second takes a fortnight once the concepts hold.

    2-3 months
    9 Skills
    Cloud Provider Fundamentals
    Virtual Machines & Compute
    VPC & Subnetting
    Security Groups & Network ACLs
    IAM & Least Privilege
    Load Balancers
    Object & Block Storage
    DNS & CDN
    Cloud Cost Fundamentals
    Show details, projects and resources

    Skills you'll master

    Cloud Provider Fundamentalsintermediate
    Virtual Machines & Computeintermediate
    VPC & Subnettingadvanced
    Security Groups & Network ACLsintermediate
    IAM & Least Privilegeadvanced
    Load Balancersintermediate
    Object & Block Storageintermediate
    DNS & CDNintermediate
    Cloud Cost Fundamentalsbeginner

    Hands-on projects

    1. 01Deploy a three-tier web application with an auto-scaling group behind a load balancer, then prove the scaling works by generating enough load to trigger it
    2. 02Configure a VPC with public and private subnets, a NAT gateway, and security groups following least privilege — then write down, in your own words, the path a packet takes from the internet to a private instance and back
    3. 03Set up DNS records and a CDN in front of a static site with HTTPS enforced and a documented cache invalidation procedure
    4. 04Write an IAM policy that grants exactly the permissions one service needs and nothing more, then verify it by removing a permission and observing what breaks
    5. 05Deliberately misconfigure a security group or route table, hand it to someone else, and have them diagnose it — then swap roles
    6. 06Estimate the monthly cost of your architecture before deploying it, then compare against the actual bill after a week and account for the difference

  3. CI/CD & Infrastructure as Code

    Make infrastructure repeatable, reviewed and version controlled. Done when you can destroy your entire environment and recreate it, and the result works. That test is binary: if you are afraid to run destroy, your infrastructure is not actually code. This is where most people slow down — it is the first phase that demands holding a whole system in your head.

    2-3 months
    9 Skills
    Infrastructure as Code
    Terraform
    State Management & Locking
    Module Design
    CI/CD Pipelines
    GitHub Actions
    Ansible
    Secrets Management
    Artifact & Dependency Management
    Show details, projects and resources

    Skills you'll master

    Infrastructure as Codeadvanced
    Terraformadvanced
    State Management & Lockingadvanced
    Module Designintermediate
    CI/CD Pipelinesadvanced
    GitHub Actionsadvanced
    Ansibleintermediate
    Secrets Managementintermediate
    Artifact & Dependency Managementintermediate

    Hands-on projects

    1. 01Build a pipeline that lints, tests, builds and deploys to staging on every merge to main, with the deploy gated on the tests actually passing
    2. 02Provision a complete VPC, compute fleet and database entirely from Terraform modules, with remote state and locking configured
    3. 03Run terraform destroy against your whole environment and rebuild it from scratch — then fix everything that did not come back, because something will not
    4. 04Write an Ansible playbook that configures five servers identically and idempotently, then run it twice and confirm the second run changes nothing
    5. 05Add a manual approval gate and a documented rollback to your pipeline, then practise the rollback under time pressure
    6. 06Move a hardcoded secret out of your pipeline into a secrets manager, and verify it no longer appears in logs or state files

  4. Containerization & Orchestration

    Docker and Kubernetes in depth. Done when you can explain why your image is 1.2GB and get it under 200MB, and diagnose a CrashLoopBackOff from logs and events rather than by deleting the pod and hoping. The manifests are the surface — the pages are about networking, scheduling and resource contention.

    2-3 months
    9 Skills
    Docker
    Image Optimisation & Multi-stage Builds
    Kubernetes
    Pod Scheduling & Resource Limits
    Kubernetes Networking & Services
    Persistent Storage & Volumes
    Helm Charts
    Container Security
    Container Registry
    Show details, projects and resources

    Skills you'll master

    Dockeradvanced
    Image Optimisation & Multi-stage Buildsintermediate
    Kubernetesadvanced
    Pod Scheduling & Resource Limitsadvanced
    Kubernetes Networking & Servicesadvanced
    Persistent Storage & Volumesintermediate
    Helm Chartsintermediate
    Container Securityintermediate
    Container Registryintermediate

    Hands-on projects

    1. 01Containerise a multi-service application with a Dockerfile per service and a compose file for local development
    2. 02Cut one of those images by at least 60% using multi-stage builds and a smaller base, and record what each change saved
    3. 03Deploy to a Kubernetes cluster with resource limits, liveness and readiness probes, and a rolling update strategy that you verify causes no dropped requests
    4. 04Package the application as a Helm chart with separate values for staging and production
    5. 05Break a running deployment four ways — bad image tag, missing config, insufficient memory, failing probe — and diagnose each from kubectl output alone
    6. 06Add a vulnerability scan to your image build and fix what it finds, or document why a finding is acceptable

  5. Monitoring & Site Reliability

    Make the system you built observable. Done when you can answer "was it healthy last Tuesday at 3pm?" with data rather than opinion, and your alerts fire on user-visible symptoms rather than on CPU. Cause-based alerting is the direct route to fatigue, and fatigue is how the real page gets missed.

    3-4 months
    9 Skills
    Metrics & Instrumentation
    Prometheus
    Grafana & Dashboard Design
    Log Aggregation
    Distributed Tracing
    Alert Design & Routing
    SLI/SLO Definition
    Incident Response
    On-call & Runbooks
    Show details, projects and resources

    Skills you'll master

    Metrics & Instrumentationadvanced
    Prometheusadvanced
    Grafana & Dashboard Designintermediate
    Log Aggregationintermediate
    Distributed Tracingintermediate
    Alert Design & Routingadvanced
    SLI/SLO Definitionadvanced
    Incident Responseintermediate
    On-call & Runbooksintermediate

    Hands-on projects

    1. 01Deploy Prometheus and Grafana against the cluster from the previous phase, with a dashboard per service that someone else could read without you
    2. 02Define SLOs for one service — for example 99.5% of requests under 300ms — and build an alert that fires on error-budget burn rate rather than on a raw threshold
    3. 03Add structured logging and correlate a single request across services using a trace ID
    4. 04Rewrite one cause-based alert (high CPU, disk filling) as a symptom-based one, and explain what user impact it now represents
    5. 05Write an on-call runbook for one service, then have someone unfamiliar with it follow the runbook during a simulated incident
    6. 06Run a tabletop incident exercise and produce a blameless postmortem with action items that are assigned to someone

  6. DevSecOps & Supply Chain Security

    Security as a pipeline gate, not a final review. Done when a dependency with a known critical CVE or an unsigned image cannot reach production, and you can name the policy that blocked it rather than a person who happened to notice.

    3-4 weeks
    7 Skills
    DevSecOps Practices
    Dependency & Vulnerability Scanning
    Container & Image Signing
    Policy as Code
    Secrets Scanning
    Software Bill of Materials (SBOM)
    Supply Chain Threat Modelling
    Show details, projects and resources

    Skills you'll master

    DevSecOps Practicesadvanced
    Dependency & Vulnerability Scanningadvanced
    Container & Image Signingintermediate
    Policy as Codeintermediate
    Secrets Scanningintermediate
    Software Bill of Materials (SBOM)intermediate
    Supply Chain Threat Modellingintermediate

    Hands-on projects

    1. 01Add dependency and container scanning to your pipeline and configure it to block a merge when a critical vulnerability is found
    2. 02Sign your container images and add a policy that refuses to deploy an unsigned image, then verify by attempting to deploy one
    3. 03Generate an SBOM for a real service and use it to answer "are we affected by this CVE" in under five minutes
    4. 04Write a policy-as-code rule that blocks a deploy failing a specific compliance check, and show it failing on a deliberately bad manifest
    5. 05Scan your git history for a secret that was committed and removed, and document the rotation procedure you would run for a real leak

  7. Platform Engineering & Developer Experience

    Build the platform other engineers use to ship, not just your own deploys. Done when a developer outside your team provisions a new environment from a self-service template without opening a ticket to you, and the golden path is the fast path, not a document nobody follows.

    3-4 weeks
    6 Skills
    Internal Developer Platforms
    Golden-Path Templates
    Self-Service Provisioning
    Kubernetes Operators & CRDs
    Developer Portal Design
    Platform API Design
    Show details, projects and resources

    Skills you'll master

    Internal Developer Platformsadvanced
    Golden-Path Templatesadvanced
    Self-Service Provisioningintermediate
    Kubernetes Operators & CRDsintermediate
    Developer Portal Designintermediate
    Platform API Designintermediate

    Hands-on projects

    1. 01Design and document an internal developer platform that lets a team self-serve a new environment from a golden-path template, and have someone use it without your help
    2. 02Build a self-service template that provisions a new service with CI/CD, monitoring and access control already wired in, and time how long it takes a new user
    3. 03Write a custom Kubernetes operator or CRD that automates a repetitive provisioning task, and show it handling a failure case correctly
    4. 04Stand up a developer portal listing your platform's templates and services, then get feedback from a real user and act on it
    5. 05Measure how long a golden-path deployment takes versus the old manual process, and report the difference

  8. Cost Governance & Resilience

    The two failure modes nobody notices until the invoice or the outage: spend that grows quietly, and a recovery procedure that was never actually tested. Done when you can show a real rightsizing saving with a number attached, and you have restored a service from backup into a clean environment and timed it — not assumed it would work.

    3-4 weeks
    6 Skills
    Cost Optimisation (FinOps)
    Resource Rightsizing
    Disaster Recovery Planning
    Backup & Restore Strategy
    Chaos Engineering Basics
    Budget Alerts & Showback
    Show details, projects and resources

    Skills you'll master

    Cost Optimisation (FinOps)advanced
    Resource Rightsizingintermediate
    Disaster Recovery Planningadvanced
    Backup & Restore Strategyintermediate
    Chaos Engineering Basicsintermediate
    Budget Alerts & Showbackintermediate

    Hands-on projects

    1. 01Run a cost audit on a real cloud account, identify reclaimable spend with a rightsizing plan, and quantify what you actually saved after acting on it
    2. 02Set up budget alerts and a per-team cost showback report, and get one team to change behaviour based on what it showed them
    3. 03Write and test a disaster recovery procedure by restoring a service from backups into a clean environment, and record the real recovery time against your target
    4. 04Run a chaos experiment that kills a production-representative instance during business hours (in a non-production environment) and confirm your system recovers as designed
    5. 05Find one over-provisioned resource in a real account, resize it, and monitor for a week to confirm nothing broke

  9. Specialization & Advanced Topics

    Pick a direction — platform engineering, cloud architecture, or a specific compliance domain — and build the portfolio piece that shows judgment rather than tool familiarity. Done when someone outside your team used something you built without you walking them through it.

    2-3 months
    6 Skills
    Cloud Architecture
    Multi-Cloud & Hybrid Strategy
    Technical Writing & Documentation
    Open Source Contribution
    Architecture Decision Records
    Stakeholder Communication
    Show details, projects and resources

    Skills you'll master

    Cloud Architectureadvanced
    Multi-Cloud & Hybrid Strategyintermediate
    Technical Writing & Documentationintermediate
    Open Source Contributionintermediate
    Architecture Decision Recordsintermediate
    Stakeholder Communicationintermediate

    Hands-on projects

    1. 01Get one non-trivial pull request merged into an open-source DevOps tool — a fix, a feature or documentation that someone needed
    2. 02Write a design document for a system you have not built, get it reviewed by someone more senior, and revise it based on their feedback
    3. 03Write an architecture decision record for a real tradeoff you made earlier in this roadmap, including the options you rejected and why
    4. 04Present a system you built to someone technical who was not involved, and answer their questions without falling back on "it just works"
    5. 05Mentor someone earlier in this roadmap through one project from your own path, and note what you had to re-explain that you thought was obvious

What the job is actually like

Day to day
Less building and more unblocking than the job description implies. A normal week is a pipeline that fails for a reason unrelated to the change, a team that needs an environment, an upgrade deferred twice already, and somewhere in there the automation work you were actually hired for. The interrupt rate is the defining feature of the role, and the engineers who are happy in it treat each interrupt as a defect in the system rather than as a favour. Whether the job is a good one comes down to a single question: does anybody protect time to remove the reasons people keep asking.
The interview
Broad rather than deep, which is the honest signal about the role itself. Expect a Linux and troubleshooting round run as a scenario, a pipeline design question, and infrastructure as code read or written in front of someone. Containers and Kubernetes come up in almost every process now, at least at the level of explaining what a failing pod is telling you. The behavioural round asks about a production incident and about something you automated away. Because the title covers wildly different jobs at different companies, the most useful thing you can do is ask what the last three tickets actually looked like.
How people get in
The most common first operations job, which is also why it is the most crowded. People arrive from system administration, from support, and from development teams where they became the person who understood the build. What transfers from all three is patience with other people's systems. The thing worth knowing early is that this role is increasingly a stepping stone rather than a destination: the reliability path is where owning service behaviour goes, the platform path is where building for other engineers goes, and cloud security, observability and cost engineering each began as a phase of this one.
After senior
Almost all of it is sideways into a specialisation rather than upwards within the title. Site reliability engineering trades pipelines for service ownership and error budgets. Platform engineering treats the internal toolchain as a product with users. Cloud security, observability and FinOps each take one phase of this roadmap and make it the entire job, and each pays better than the generalist role it grew out of. Senior and lead DevOps titles exist and are real, but the ceiling is lower than any of those specialisations, and that gap is the single most useful fact on this page.
Why people leave
Burnout by interrupt is the common one — a role defined entirely by other teams' urgency, where the automation backlog never moves because there is always a ticket. The second is becoming the human glue: valuable, hard to replace, and invisible to a promotion committee that cannot point at what you built. The third is tool identity, where the CV is a list of products rather than of problems solved, which ages badly every time the industry changes its favourite. The mitigation for all three is the same and it is uncomfortable: pick a specialisation early and spend deliberate time going deep.

Frequently asked questions

Related certifications

Related roadmaps