Building Security Champions
summary
There are 3.5 million unfilled cyber jobs, so the claim is that a security champions program scales security capacity with big ROI by teaching and delegating rather than doing everything centrally. Concrete practices: recruit, engage, teach, recognize, reward, don’t stop; monthly touchpoints and open office hours; train champions in secure coding, threat modeling, whiteboard architecture, and hands‑on code review (spot input validation, output encoding, parameterized queries); delegate bug fixes and upgrades but keep SAST validation and approvals centralized; recognize in performance reviews and reward with training, books or CTFs.
AI-written summary · about
chapters (34)
- 0:00Intro
- 0:53Scaling
- 1:50Recipe
- 2:43Who is Tanya
- 3:35The problem
- 4:08Solutions
- 4:24Security Champions
- 5:19What is a Security Champion
- 6:20Building Security Champion
- 6:35Recruiting Champions
- 9:41Engaging Champions
- 10:06Sharing Secrets
- 11:00Mailing List
- 12:46What should we teach
- 12:56Dont teach piles of crap
- 14:08What do we teach them
- 15:10What we teach them
- 17:35More your policies
- 19:49Tooling
- 21:41Coaching
- 22:53Office Hours
- 24:46Delegation
- 25:46Validation
- 27:09Recognize
- 27:51Certificate
- 29:09Recognition
- 29:38Peer Recognition
- 30:14Rewards
- 31:52Communication
- 32:27Consistency
- 34:01Conclusion
- 34:45Resources
- 35:30Podcast
- 36:15Resource
related talks
51mBuilding Security Champions
27mSecurity Champions: The What, Why, and How
49mTransforming Security Champions
40mSecurity Champions: Drive Innovation by Creating Future Cyber Workforce
32mBeyond training: Building a high-impact security champions program
36mChampioning Security: Scaling Security at Every Level
35mSDL at Scale: Growing Security Champions
32mSecurity Champions? Introduce them in your Organisation