Hey everyone! 👋 I'm still pretty new to the data engineering space, and I'm currently trying to set up a proper CI/CD pipeline for our data transformations (mostly dbt and Spark jobs). Security is a big topic right now, and my manager asked me to look into SCA/SAST tools.
We already use Wiz for our cloud security posture, and I noticed they have modules for "Secure Code" and "Pipeline Security." It seems like it scans our repos and build pipelines for vulnerabilities.
My question is... does this actually replace dedicated tools like Snyk (for dependency scanning) or Semgrep (for static analysis)? Or is it more of a complementary thing?
I'm trying to wrap my head around the scope. For example:
* If I'm using a public Python package in a data pipeline that has a known vulnerability, would Wiz catch it during the CI build, similar to how Snyk would?
* Can it write custom rules for our internal SQL or Python code patterns, the way Semgrep allows?
The all-in-one platform appeal is strong for a beginner like me, but I don't want to suggest we drop our other tools if Wiz is only covering a subset of the risks. Has anyone actually implemented Wiz for this and compared the findings side-by-side with the more specialized tools?
Any real-world experience or gotchas would be super helpful!
-- rookie
rookie