diff --git a/library/common/1.0.0/templates/lib/pod/_podSecurityContext.tpl b/library/common/1.0.0/templates/lib/pod/_podSecurityContext.tpl
new file mode 100644
index 0000000000..928d3c84cb
--- /dev/null
+++ b/library/common/1.0.0/templates/lib/pod/_podSecurityContext.tpl
@@ -0,0 +1,68 @@
+{{/* Returns Pod Security Context */}}
+{{/* Call this template:
+{{ include "ix.v1.common.lib.pod.securityContext" (dict "rootCtx" $ "objectData" $objectData) }}
+rootCtx: The root context of the template. It is used to access the global context.
+objectData: The object data to be used to render the Pod.
+*/}}
+{{- define "ix.v1.common.lib.pod.securityContext" -}}
+  {{- $rootCtx := .rootCtx -}}
+  {{- $objectData := .objectData -}}
+
+  {{- $secContext := dict -}}
+
+  {{/* Initialize from the "global" option */}}
+  {{- with $rootCtx.Values.securityContext.pod  -}}
+    {{- $secContext = (mustDeepCopy .) -}}
+  {{- end -}}
+
+  {{/* Override with pod's option */}}
+  {{- with $objectData.podSpec.securityContext -}}
+    {{- $secContext = mustMergeOverwrite $secContext . -}}
+  {{- end -}}
+
+  {{/* TODO: Add supplemental groups
+    scaleGPU (44) (Only when GPU is enabled on the pod's containers)
+    devices (5, 10, 20, 24) (Only when devices is assigned on the pod's containers) */}}
+  {{/* TODO: Add sysctls
+    net.ipv4.ip_unprivileged_port_start: (Set to the lowest port on the pod's containers)
+    net.ipv4.ping_group_range: (Set to the lowest port and highest port on the pod's containers)
+  */}}
+
+  {{- if not $secContext.fsGroup -}}
+    {{- fail "Pod - Expected non-empty <fsGroup>" -}}
+  {{- end -}}
+
+  {{- if not $secContext.fsGroupChangePolicy -}}
+    {{- fail "Pod - Expected non-empty <fsGroupChangePolicy>" -}}
+  {{- end -}}
+
+  {{- $policies := (list "Always" "OnRootMismatch") -}}
+  {{- if not (mustHas $secContext.fsGroupChangePolicy $policies) -}}
+    {{- fail (printf "Pod - Expected <fsGroupChangePolicy> to be one of [%s], but got [%s]" (join ", " $policies) $secContext.fsGroupChangePolicy) -}}
+  {{- end }}
+fsGroup: {{ $secContext.fsGroup }}
+fsGroupChangePolicy: {{ $secContext.fsGroupChangePolicy }}
+  {{- with $secContext.supplementalGroups }}
+supplementalGroups:
+    {{- range . }}
+  - {{ . }}
+    {{- end -}}
+  {{- else }}
+supplementalGroups: []
+  {{- end -}}
+  {{- with $secContext.sysctls }}
+sysctls:
+    {{- range $name, $value := . }}
+    {{- if not $name -}}
+      {{- fail "Pod - Expected non-empty <name> in <sysctls>" -}}
+    {{- end -}}
+    {{- if not $value -}}
+      {{- fail "Pod - Expected non-empty <value> in <sysctls>" -}}
+    {{- end }}
+  - name: {{ $name }}
+    value: {{ $value }}
+    {{- end -}}
+  {{- else }}
+sysctls: []
+  {{- end -}}
+{{- end -}}
diff --git a/library/common/1.0.0/templates/lib/workload/_pod.tpl b/library/common/1.0.0/templates/lib/workload/_pod.tpl
index 19d7fde48e..e2b4da03e7 100644
--- a/library/common/1.0.0/templates/lib/workload/_pod.tpl
+++ b/library/common/1.0.0/templates/lib/workload/_pod.tpl
@@ -42,7 +42,8 @@ terminationGracePeriodSeconds: {{ . }}
 tolerations:
     {{- . | nindent 2 }}
   {{- end }}
-#TODO:securityContext:
+securityContext: {{/* TODO: Unit Tests */}}
+  {{- include "ix.v1.common.lib.pod.securityContext" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim | nindent 2 }}
 #TODO:containers:
 #TODO:initContainers:
 {{- with (include "ix.v1.common.lib.pod.volumes" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim) }}
diff --git a/library/common/1.0.0/values.yaml b/library/common/1.0.0/values.yaml
index 8b9e8dbc74..dcda15aff0 100644
--- a/library/common/1.0.0/values.yaml
+++ b/library/common/1.0.0/values.yaml
@@ -63,6 +63,8 @@ securityContext:
     readOnlyRootFilesystem: true
     allowPrivilegeEscalation: false
     privileged: false
+    seccompProfile:
+      type: RuntimeDefault
     capabilities:
       add: []
       drop:
@@ -74,8 +76,6 @@ securityContext:
     fsGroupChangePolicy: OnRootMismatch
     supplementalGroups: []
     sysctls: {}
-      # net.ipv4.ip_unprivileged_port_start: "0"
-      # net.ipv4.ping_group_range:
 
 # -- Resources
 # Can be overruled per container