Cloud-native architectures have transformed enterprise application development by enabling scalability, resilience, and rapid delivery through microservices, containers, and orchestration platforms such as Kubernetes. However, this shift has significantly expanded the attack surface, introducing new security challenges across distributed systems, dynamic infrastructure, and automated CI/CD pipelines. DevSecOps has emerged as a critical paradigm that integrates security practices directly into development and operations workflows, ensuring continuous security validation throughout the software lifecycle rather than as a post-deployment activity.
This paper explores cloud-native DevSecOps security frameworks designed for enterprise-grade application development and deployment pipelines. It examines how security controls can be embedded into infrastructure-as-code, containerized environments, and continuous integration/continuous deployment (CI/CD) pipelines to enforce policy-as-code, automate vulnerability detection, and ensure compliance at scale. The study also evaluates key frameworks, including Zero Trust Architecture, Shift-Left Security, and GitOps-based security models, highlighting their applicability in modern enterprise environments
Furthermore, it investigates tooling ecosystems such as automated static and dynamic analysis, container image scanning, secrets management, and runtime security monitoring. The paper proposes a structured methodology for integrating DevSecOps practices into cloud-native pipelines, emphasizing automation, observability, and governance. The findings aim to support enterprises in building secure, scalable, and resilient cloud-native applications while maintaining development velocity and operational efficiency.
