Sign In

Git for Security Professionals

Version control every change. Prove who made it.

Security work is made of files that change, that several people touch, and that someone will one day ask you to account for: detection rules, IR playbooks, scripts, Conditional Access policy, control evidence. Kept in a shared folder, that work has no memory, no safe way to edit together, and no proof of who changed what or when. This course teaches Git for that work specifically. You put any artifact under version control, collaborate through branches and review, keep secrets out and purge them when they slip in, sign your commits for provenance, and automate the checks that protect a repository, across detection, DFIR, architecture, and governance.

Included with Premium, from $19.99/month, or $179/year and save 25%. Preview the first module free, no account needed.
Your subscription also includes the Practice Hub: graded scenarios, forensic cases, query drills and the response playbooks.
Preview Course See Pricing Download Syllabus
View Pricing Take End of Course Exam → 8 CPE Credits

What you'll be able to do

✓Put any security artifact under version control with a full, attributed history: detection rules, IR playbooks, scripts, policy exports, and audit evidence
✓Run the daily Git workflow with intent: stage precisely, write commit messages that hold up, read history with log, diff, and blame, and undo changes without panic
✓Collaborate on shared security work through branches and pull requests, with review and branch protection so nothing reaches main unreviewed
✓Resolve merge conflicts and recover lost work with the reflog, and know exactly when rewriting history is safe and when it is not
✓Keep secrets out of a repository, purge them from history when they slip in, and sign your commits so provenance is verified rather than typed
✓Build CI that validates a security artifact before it ships, and run the whole workflow end to end from a branch to a protected, automated deploy
SEC204 | Essentials tier | 6 modules across 4 phases | 8-10 hours at your own pace | 8 CPE credits | Updated July 2026

Course Syllabus

Every module and every lesson. Open a module to see its lessons.

Download the full syllabus (PDF)

Course Orientation

GT0
Course OrientationCourse Preview

What Git for Security Professionals teaches: give your security work a memory.

Phase 1: Foundations

GT1
Git Foundations

The foundation the whole course stands on.

8 lessonsHide lessons
  1. 1.1 Your First Repository
  2. 1.2 The Four-Stage Model
  3. 1.3 What a Commit Actually Is
  4. 1.4 Reading History
  5. 1.5 Working with a Remote
  6. 1.6 A Repository for Security Work
  7. Module Summary
  8. Check My Knowledge
GT2
The Daily Workflow

Turn the foundations into fluency. Run the daily edit-stage-commit-sync loop as a discipline, write commit messages that hold up under review, stage selectively so every commit is one clean change, undo safely...

8 lessonsHide lessons
  1. 2.1 The Daily Loop
  2. 2.2 Commit Messages That Hold Up
  3. 2.3 Staging with Intent
  4. 2.4 Undoing Safely
  5. 2.5 Ignoring, Cleaning, and Stashing
  6. 2.6 Making the Workflow Yours
  7. Module Summary
  8. Check My Knowledge

Phase 2: Collaboration

GT3
Branching and Collaboration

Work alongside a team without collisions.

8 lessonsHide lessons
  1. 3.1 What a Branch Is
  2. 3.2 Working on a Branch
  3. 3.3 Merging
  4. 3.4 Merge vs Rebase
  5. 3.5 Collaborating Through a Remote
  6. 3.6 The Pull Request Workflow
  7. Module Summary
  8. Check My Knowledge
GT4
Conflicts, History, and Recovery

Handle the situations collaboration produces.

8 lessonsHide lessons
  1. 4.1 Understanding Merge Conflicts
  2. 4.2 Conflicts in Practice
  3. 4.3 Rewriting History with Interactive Rebase
  4. 4.4 Rewriting History Safely
  5. 4.5 Recovery with the Reflog
  6. 4.6 Finding a Bad Commit with git bisect
  7. Module Summary
  8. Check My Knowledge

Phase 3: Securing Git

GT5
Securing Git

Secure the repository itself. Keep secrets out of history with ignore rules and the right habits, catch the ones that slip through with secret-scanning hooks and push protection, respond correctly when a secret leaks...

8 lessonsHide lessons
  1. 5.1 Keeping Secrets Out of a Repository
  2. 5.2 Secret Scanning and Pre-commit Hooks
  3. 5.3 Responding to a Leaked Secret
  4. 5.4 Verifying Commit Authorship with Signing
  5. 5.5 Protecting Branches and the Repository
  6. 5.6 Access, Credentials, and Repository Hygiene
  7. Module Summary
  8. Check My Knowledge

Phase 4: Automation and Capstone

GT6
CI/CD for Security Work

Turn a version-controlled security repository into a pipeline that ships.

8 lessonsHide lessons
  1. 6.1 What CI/CD Is and Why It Matters for Security Work
  2. 6.2 Your First Pipeline: Validating a Change
  3. 6.3 Testing Security Content in the Pipeline
  4. 6.4 Deploying Automatically
  5. 6.5 Securing the Pipeline Itself
  6. 6.6 Capstone: The Whole Workflow End to End
  7. Module Summary
  8. Check My Knowledge

Phase 0: Course Resources

GT90
Cheatsheets

The commands that matter, what each one actually moves, how to recover, and the security work Git makes possible.

4 lessonsHide lessons
  1. The Model and the Daily Loop
  2. Branching, Merging and Getting Back
  3. Keeping Secrets Out, and What to Do When One Gets In
  4. Pipelines for Security Content
GT91
Cookbooks

Ordered procedures for standing up a content repository, reviewing a change, responding to a leak, and recovering from a bad rewrite.

4 lessonsHide lessons
  1. Standing Up a Security Content Repository
  2. Responding to a Committed Credential
  3. Reviewing a Detection Change
  4. Recovering From a Bad Rewrite
GT93
Walkthroughs

Four cases reasoned end to end, including the green pipeline that deployed nothing and the commit signed by nobody.

4 lessonsHide lessons
  1. The Pipeline That Deployed Nothing
  2. The Commit Nobody Wrote
  3. The Key That Had Been There Two Years
  4. The Afternoon That Disappeared
GT95
Playground

A throwaway repository, a free host account, and the four experiments worth running deliberately.

GT96
Operational Reference

Every command, workflow, and pipeline snippet from the course in one searchable reference, organized by task, from daily workflow and history recovery to signing, branch protection, and CI/CD.

1 lessonsHide lessons
  1. GT99.1 Operational Reference
GT97
References & Further Reading

Git documentation, commit-signing references, platform docs for branch protection and CI/CD, secret-scanning and history-rewriting tools, supply-chain security resources, and secure-development standards used...

1 lessonsHide lessons
  1. GT100.1 References & Further Reading

Course Completion

Course Exam

Git for Security Professionals end-of-course exam: a committed credential reported as remediated because the file was deleted, testing whether you know the difference between a working tree and a history and what the...

1 lessonsHide lessons
  1. Course Completion. Git for Security Professionals

Course overview

Git for Security Professionals teaches version control as a security professional needs it, not as a software developer is taught it. You start from your first commit and the model underneath it, learn the daily workflow, collaborate on shared work through branches and pull requests, resolve conflicts and recover lost work, secure the repository itself, and automate the checks that protect it. Every example is a real security artifact, and the moves are the same whether the file is a Sigma rule, a policy export, a collection script, or an evidence sheet. Learn how to:

✓ Put any security artifact under version control with a full, attributed history
✓ Answer who changed a rule, policy, or script, when, and why, from the history itself
✓ Collaborate through branches and pull requests so no change lands on main unreviewed
✓ Resolve merge conflicts and recover work without losing either side
✓ Keep secrets out of a repository, purge them when they get in, and sign your work for provenance

By the end you can put your own work under version control, change it safely alongside a team, and stand behind its history in an audit or an investigation.

How this course works

Security work produces artifacts that need history: detection rules, policies, playbooks, infrastructure definitions. This course teaches Git as the tool that gives them a provable audit trail, and runs the same loop for every workflow it covers.

1. Understand what Git is recording. Commits, trees and refs, before any command. Most Git confusion is a mental model problem rather than a syntax one.

2. Work in small, reviewable changes. A commit that does one thing can be reverted, reviewed and explained. A commit that does nine cannot.

3. Branch for anything that might not ship. Detection rules that need testing, policies awaiting sign-off. The branch is what makes the work safe to abandon.

4. Know how to recover. Reflog, reset, revert and the difference between them. The value of version control is entirely in the recovery, and the recovery is what nobody practices.

5. Sign what matters and automate the checks. Signed commits and CI validation turn a repository into evidence somebody else can rely on.

What this course assumes

No minimum experience and no prerequisite course. This course assumes you have never used Git, and it assumes you are not a software engineer.

What makes it go faster: comfort at a command line and something of your own worth versioning, a rule set or a policy pack. Neither is required.

What this course does not cover: software development, application security, and CI/CD as a build discipline. This is version control for security artifacts and the automation directly around them.

Who this course is for

You work in security and you work with files that change: a detection engineer versioning rules, a DFIR analyst versioning collection scripts and case notes, an architect versioning Conditional Access policy and infrastructure baselines, a GRC professional versioning policies, control mappings, and audit evidence. There is no minimum experience and no gatekeeping. Every command and concept is taught at first use, so you can start here whether you have never run a Git command or have used it loosely for years and want to work with intent. It is for you if you want to:

✓ Stop keeping critical security work in shared folders with no history or review
✓ Contribute to a shared repository confidently, without fear of overwriting a colleague
✓ Keep a leaked secret from ever reaching a repository, and clean one up when it does
✓ Prove the provenance of a change to an auditor or an investigator

What you'll learn

By the end of Git for Security Professionals you will be able to:

✓ Configure Git for provenance and put a repository under version control from the four-stage model up
✓ Run the daily workflow with intent: stage precisely, read history, and undo changes without panic
✓ Read who changed a line and why with log, show, diff, and blame
✓ Branch, open a pull request, and review a change before it merges, with protection on main
✓ Resolve merge conflicts and recover lost commits with reflog
✓ Scan for secrets, prevent them with pre-commit hooks, and purge them from history when needed
✓ Sign commits so the history carries a verified author, not a name someone typed
✓ Build CI that validates a security artifact before it ships, and run the whole workflow end to end

Key course takeaways

✓ A working command-line fluency in Git, learned as moves you repeat rather than commands you memorize
✓ The collaboration model that lets a team change shared security work safely and with a review trail
✓ The security practices a developer course skips: secret hygiene, history purging, and signed provenance
✓ A repeatable habit of putting security work under version control, whatever discipline you work in

Things you need to know

What are the prerequisites for this course?

Comfort editing a text file and running a command in a terminal. That is all. No prior Git experience is required, and every command is taught at first use. An experienced reader can skip past what they already know.

Do I need a GitHub account or any particular platform?

No. You can follow the whole course with Git on your own machine, and the hosting and review concepts are taught against GitHub, GitLab, and Azure DevOps so they apply wherever your team works. Everything is demonstrated with security artifacts and sample data, never production secrets or live systems.

Is this a detection-engineering course?

No. Detection is one of four disciplines the course serves. The examples rotate across detection rules, DFIR scripts and case artifacts, architecture and identity policy, and GRC evidence, because the version-control skills are the same for all of them. You anchor on whichever artifact you already know and the moves transfer to the rest.

How does this relate to SEC407 (Detection As Code)?

This course teaches the version-control foundation: history, collaboration, secret hygiene, and provenance for any security artifact. SEC407 teaches the pipeline that operates a detection library at scale, and it assumes exactly the Git fluency this course builds. Git for Security Professionals is the upstream course; SEC407 is one place you apply it. Neither is a prerequisite for the other, but this one comes first.

How will the course benefit your career?

Version control is assumed knowledge across modern security roles, and the professionals who use it with intent, rather than copying commands and hoping, stand out. Because the skill is vendor-neutral and applies to every discipline, it travels with you regardless of the tools an employer runs, and it is the entry point to detection-as-code, infrastructure-as-code, and policy-as-code work.

Usage rights and disclaimer

Course materials: Licensed for individual professional development. You may not redistribute course content or share account credentials.

Fictional environment: All scenarios use Northgate Engineering. Any resemblance to real organizations is coincidental.

Version and changelog

Current version: 1.0  |  Last updated: July 2026

July 2026, v1.0: Full course launch, rebuilt from the original Git skill into six teaching modules across four phases, framed by a course orientation and two reference modules. Covers Git foundations, the daily workflow, branching and collaboration, conflicts and recovery, securing Git with secret hygiene and signed provenance, and CI/CD for security work, ending with a capstone that runs the whole workflow end to end. The student finishes able to put any security artifact under version control and stand behind its history.

This course is actively maintained.

COURSE ASSESSMENT

End of Course Exam

Complete the course, then prove your skills under time pressure. Pass mark: 70. Earn your certificate with CPE credits.

40minutes
3phases
100points
1scenario
Take End of Course Exam

Requires 80% course completion. One random scenario per attempt. Certificate issued on pass.