Developer Driven Security In High-Growth Environments
summary
Claims that engineers own security and that a risk assessment takes under five minutes, with product security only handling about 10–20% of reviews. Implements custom tooling (Stride diagrams, RTMv rules, Gherkin output), stores every artifact in Snowflake as an appsec data lake, links threats to exact code lines, and routes reviewers via GitHub/Jira. Outcomes: roughly 70% low risk, 30% medium/high, threat modeling ≈1 hour, scales across ~1,000 engineers and a few percent of engineering time.
AI-written summary · about
chapters (10)
- 0:00Devsecops and data strategy
- 3:52Process scale and autonomy
- 8:59Scaling through custom tools
- 13:06Automated threat modeling
- 15:56Security validation lifecycle
- 17:34Continuous security maturity
- 21:01Appsec data lake concept
- 24:53Demonstration and workflows
- 28:05Metrics and driving maturity
- 29:52Q&A and closing insights
related talks
40mLearning to build an effective security design review program
24mBeing secure by design: Engineer-led security
45mShifting from Syntax to Secure Software Development Processes
47mSecurity is Everybody's Job
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
27mDevelopers Struggle with Application Security (and How to Make ...)
57mBuilding a Modern Security Engineering Organization
52mContinuous Security