DevOps Engineer Roadmap Explained Visually

DevOps Engineer Roadmap Explained Visually

A DevOps engineer spends the day making other engineers' code reach production safely and quickly, which in practice means writing pipelines, maintaining infrastructure as code, and being the person who finds out why the deploy broke. Realistic time to employable is nine to eighteen months if you are already a developer or sysadmin, and three to four years if you are starting from zero, because this is not an entry-level role.

Updated for 2026. Salary figures are indicative and move quarterly.

What This Role Actually Does

The job ad says "automate everything" and "own the CI/CD lifecycle."

The actual week looks like this. Monday, a pipeline that worked on Friday fails because a base image bumped a transitive dependency. Tuesday, someone's Terraform plan wants to destroy a production database and you find out why before they apply it. Wednesday, three developers are blocked because build times went from four minutes to nineteen, and you spend the day on layer caching. Thursday, a certificate expires. Friday, you write the runbook nobody will read until 3am.

The through-line is that DevOps is a support-and-leverage function. You are rarely the person shipping the feature. You are the person who makes forty engineers ship features without stepping on each other.

What people wrongly imagine it is: a role where you set up Kubernetes clusters and configure fancy tooling all day. Cluster setup is a one-week task you do once every two years. The rest is unglamorous — permissions, secrets rotation, cost anomalies, flaky tests that only fail in CI, and a great deal of talking to people about why their thing cannot be deployed the way they want.

The second misconception is that DevOps is a technology stack. It is a working practice that got a job title attached. The tools change every three years; the practice does not.

DevOps vs SRE vs Platform Engineer

The honest summary: SRE is DevOps with a measurement framework and a pager, platform engineering is DevOps productised for internal customers, and most companies under 500 people use all three titles to mean the same job.

The Roadmap

Seven stages. They are ordered by dependency, not by popularity — the popular things are at the end for a reason.

Stage 1 — Linux and the Command Line

What to learn: the filesystem hierarchy, permissions and ownership, processes and signals, systemd units, package managers, ssh including key-based auth, log locations, and text processing with grep, sed, awk, and pipes. Then Bash scripting: variables, conditionals, loops, exit codes, set -euo pipefail, and argument parsing.

Realistic time: 6–10 weeks at 8–10 hours per week.

Free resources by name: the Linux Journey site, OverTheWire Bandit (a wargame that teaches shell navigation by forcing it), the freeCodeCamp Linux and Bash video courses, and man pages read deliberately rather than skimmed. Linux Upskill Challenge on Reddit is a free structured month.

Portfolio project: take a fresh cloud VM and, using only a shell, install and serve a static site behind nginx with TLS from Let's Encrypt, a non-root deploy user, a firewall, and a systemd service. Then write a Bash script that does the whole thing from scratch on a blank machine.

How you know you are done: you can diagnose a service that will not start using only systemctl status, journalctl, and file permissions, without searching for the error message.

Stage 2 — Networking and How the Internet Actually Works

What to learn: the TCP/IP model, DNS resolution end to end, HTTP and HTTPS including what the TLS handshake exchanges, ports and sockets, CIDR notation and subnetting, NAT, load balancers, reverse proxies, and firewalls. Add the diagnostic tools: dig, curl -v, ss, traceroute, tcpdump at a basic level.

Realistic time: 4–6 weeks.

Free resources by name: Julia Evans' free networking zines and blog posts, the Cloudflare Learning Center articles on DNS and TLS, Beej's Guide to Network Programming for the socket layer, and the freeCodeCamp networking fundamentals course.

Portfolio project: buy a cheap domain, point it at your Stage 1 server, and document — in a written README with diagrams — every step a browser request takes from typing the URL to receiving bytes, including which DNS records you created and why.

How you know you are done: you can explain a "connection refused" versus a "connection timed out" versus a DNS failure, and know which tool distinguishes them.

Stage 3 — Git, and Writing Enough Code to Be Dangerous

What to learn: Git beyond commit and push — branching strategies, rebase versus merge, resolving conflicts, bisect, reflog, and pull request workflow. Alongside it, Python to a genuinely working level: file and API interaction, error handling, virtual environments, requests, boto3 or the equivalent cloud SDK, and writing a script someone else can run.

Realistic time: 6–8 weeks, longer if you have never programmed.

Free resources by name: the free Pro Git book by Scott Chacon, Learn Git Branching (a browser visualiser), Python for Everybody by Charles Severance on freeCodeCamp, and the Automate the Boring Stuff with Python free online edition.

Portfolio project: a Python CLI tool that queries a cloud provider API and reports something useful — for example, every untagged resource or every security group open to 0.0.0.0/0 — with proper argument parsing, error handling, and a README.

How you know you are done: you have recovered a repository from a bad rebase without deleting the folder and re-cloning, and you have written a script over 150 lines that another person ran successfully.

Stage 4 — Containers

What to learn: what a container actually is at the kernel level (namespaces and cgroups, briefly), images versus containers, layer caching, writing a Dockerfile you are not ashamed of, multi-stage builds, .dockerignore, volumes versus bind mounts, container networking, and Docker Compose for multi-service local environments. Then container registries and image scanning.

Realistic time: 4–6 weeks.

Free resources by name: the official Docker documentation get-started guide, Play with Docker for a free browser sandbox, KodeKloud's free Docker labs tier, and freeCodeCamp's Docker course.

Portfolio project: containerise a three-service application — an API, a database, and a cache — with Docker Compose, a multi-stage build that produces an image under 100MB, health checks, and a documented explanation of why each layer is ordered as it is.

How you know you are done: you can debug a container that exits immediately without logs, and your rebuild after a source-file change takes seconds rather than minutes.

Stage 5 — One Cloud Provider, Properly

What to learn: pick one — AWS, Azure, or Google Cloud Platform — and do not spread. Core compute, object storage, the virtual network layer, managed databases, identity and access management, and the provider's own CI and secrets services. IAM is the part people skip and the part that gets asked about in every interview.

Realistic time: 8–12 weeks.

Free resources by name: the AWS Free Tier with AWS Skill Builder's free digital courses, Microsoft Learn (genuinely comprehensive and entirely free for Azure), Google Cloud Skills Boost free tier, and A Cloud Guru's free-tier courses. Set a billing alarm at one dollar before you launch anything.

Portfolio project: deploy your Stage 4 application to the cloud entirely through the console first — VPC, subnets, security groups, a managed database, a load balancer — then write down every click. That written list becomes Stage 6's input.

How you know you are done: you can explain why your application in a private subnet can reach the internet but the internet cannot reach it, in terms of route tables and gateways.

Stage 6 — Infrastructure as Code and CI/CD

What to learn: Terraform — providers, resources, variables, outputs, modules, remote state, state locking, plan versus apply, and importing existing resources. Then CI/CD: GitHub Actions as a default, plus exposure to GitLab CI or Jenkins. Build pipelines with caching, matrix jobs, secrets handling, environments, and manual approval gates. Add configuration management basics with Ansible.

Realistic time: 10–14 weeks. This is the longest stage and the most directly hireable.

Free resources by name: the official Terraform documentation and HashiCorp's free Learn tutorials, the GitHub Actions documentation, KodeKloud's free Terraform labs, and the Ansible official getting-started guide.

Portfolio project: rebuild your entire Stage 5 cloud deployment in Terraform with zero console clicks, split into modules, with remote state in object storage, and a GitHub Actions pipeline that runs fmt, validate, plan on pull request and apply on merge to main. Destroy it and recreate it from nothing to prove it works.

How you know you are done: you ran terraform destroy, then terraform apply, and got a working environment back without touching a console.

Stage 7 — Kubernetes, Observability, and Security

What to learn: Kubernetes — pods, deployments, services, ingress, ConfigMaps, secrets, namespaces, resource requests and limits, and why a pod is stuck in Pending. Then observability: metrics with Prometheus, dashboards with Grafana, structured logging, distributed tracing concepts, and alerting that does not cry wolf. Finally security fundamentals: least-privilege IAM, secrets management with HashiCorp Vault or the cloud-native equivalent, dependency and image scanning, and supply-chain basics.

Realistic time: 12–16 weeks.

Free resources by name: the official Kubernetes documentation tutorials, minikube or kind for a free local cluster, KodeKloud's free Kubernetes labs and the Kubernetes the Hard Way guide by Kelsey Hightower, Prometheus and Grafana official docs, and the OWASP top ten for the security layer.

Portfolio project: run your application on a local Kubernetes cluster with a Helm chart, horizontal pod autoscaling, a Prometheus and Grafana stack showing real request metrics, and one alert rule that fires when error rate exceeds a threshold. Write a postmortem for a failure you deliberately caused.

How you know you are done: you can debug a pod stuck in CrashLoopBackOff or ImagePullBackOff from first principles, and your Grafana dashboard answers a question rather than just looking busy.

Salary and Job Titles

Figures below are indicative ranges in USD drawn from the kind of data published by Levels.fyi, Glassdoor aggregates, the Stack Overflow Developer Survey, and US Bureau of Labor Statistics occupational data for related computer and information technology occupations. They are not precise, they vary enormously by city and company tier, and they move quarterly.

United States (USD, base salary)

Large technology companies pay substantially above these bands once equity is included, and total compensation at that tier can be one and a half to two times base. Non-technology employers in lower-cost metros sit well below.

Canada (CAD, base salary)

Canadian bands run meaningfully below US bands for the same work, with Toronto and Vancouver at the top of the domestic range. The USD conversions above are approximate and shift with the exchange rate.

State this plainly to yourself: these are indicative aggregates, not offers. Verify against current Levels.fyi data for your specific city and company before using any number in a negotiation.

Who Should Not Take This Path

Some people will be genuinely unhappy in this role, and it is worth knowing before you spend two years getting there.

You want to build product. DevOps is a leverage role. Your best work is invisible, and the feature that shipped will be credited to someone else. If you need to point at a user-facing thing you made, this will grind you down.

You cannot tolerate interruption. Your day is other people's emergencies. Deep uninterrupted focus blocks are rare and frequently destroyed.

You dislike being on call. Most DevOps and all SRE roles involve a pager rotation. It is not constant, but it will wake you at 3am several times a year, and it changes how you plan weekends.

You want a clean, finished system. Infrastructure is permanently half-migrated. There is always a legacy pipeline nobody dares touch and a Terraform module written in 2021 by someone who left.

You are hoping to skip programming. The old sysadmin path where you never wrote code is closed. Modern infrastructure work is software engineering applied to systems, and people who resist that plateau early.

You need a fast entry into tech. If your goal is employment in twelve months, target software development, QA automation, or IT support instead. Come back to DevOps from there.

The Five Mistakes

1. Starting with Kubernetes. It is the headline item on job ads, so beginners begin there, and end up able to copy manifests without understanding what breaks. Kubernetes is an abstraction over Linux, networking, and containers. Learn what it abstracts first, and it becomes easy.

2. Learning three clouds at once. Breadth across AWS, Azure, and GCP at a shallow level signals nothing. Depth in one signals competence and transfers to the others in weeks. Pick the one your target employers use and commit.

3. Collecting certifications instead of building. A shelf of badges with no repository behind it reads as someone who studied rather than someone who built. One associate-level cloud certification plus three real projects beats five certifications alone, every time.

4. Never destroying anything. If you have only ever created infrastructure, you have not tested it. Run terraform destroy and rebuild. Kill a pod. Fill a disk. The confidence that gets you through an interview comes from having broken things on purpose.

5. Applying to DevOps roles with no production exposure. The response rate is close to zero and it is demoralising for reasons that have nothing to do with your ability. Take the developer job, the IT support job, or the cloud support job first, then move sideways from inside where you can point at real systems you operated.

Print This Section

DEVOPS ENGINEER ROADMAP — STAGE SUMMARY

1. LINUX + BASH                  6-10 weeks
   Permissions, systemd, processes, logs, scripting
   Project: full server setup from a blank VM via script
   Done when: you debug a dead service without googling

2. NETWORKING                    4-6 weeks
   TCP/IP, DNS, HTTP/TLS, CIDR, load balancers, dig/curl/ss
   Project: documented request path for your own domain
   Done when: refused vs timeout vs DNS is obvious to you

3. GIT + PYTHON                  6-8 weeks
   Branching, rebase, bisect, PR flow; Python + cloud SDK
   Project: CLI tool auditing cloud resources
   Done when: you recovered a bad rebase without re-cloning

4. CONTAINERS                    4-6 weeks
   Images, layers, multi-stage builds, Compose, registries
   Project: 3-service app, image under 100MB, health checks
   Done when: you debug a container that exits with no logs

5. ONE CLOUD                     8-12 weeks
   Compute, storage, VPC, managed DB, IAM, billing alarms
   Project: console-deployed app + written click log
   Done when: you can explain private subnet egress

6. IAC + CI/CD                   10-14 weeks   <- most hireable
   Terraform modules, remote state; GitHub Actions pipelines
   Project: whole environment as code, destroy and rebuild
   Done when: destroy then apply gives you back production

7. K8S + OBSERVABILITY + SEC     12-16 weeks
   Pods, ingress, limits; Prometheus, Grafana, alerts; IAM, Vault
   Project: local cluster + real metrics + one useful alert
   Done when: CrashLoopBackOff is a diagnosis, not a mystery

TOTAL: 12-18 months from developer/sysadmin
       3-4 years from zero technical background
DevOps is not an entry-level role. Arrive via dev or ops.

🔗 Next: the Cloud Engineer Roadmap With Free Resources covers Stage 5 in far more depth, and the Kubernetes Cheat Sheet is the reference to keep open during Stage 7. Compare this against every other track in Tech Career Roadmaps Compared.