Building Security Champions
summary
Scaling security by building a champions program instead of hiring dozens requires a concrete recipe: recruit engage teach recognize reward with manager buy in, volunteer champions, monthly one‑on‑ones and open office hours. Teach only needed skills — threat modeling, secure code review, policy compliance — and tool use like scan with ZAP and triage false positives. Delegate routine fixes but keep approvals, recognize work in reviews, reward with time or keys, and sustain it so one audit spike of 43,000 findings becomes manageable (e.g., prioritize two fix patterns across 101 instances).
AI-written summary · about
chapters (31)
- 0:00Intro
- 3:14Who is Tanya
- 4:20The problem
- 5:27Scaling
- 6:19Security Champion
- 10:05Recipe
- 10:15Recruiting
- 17:23Engagement Software Developers
- 20:33Meeting with Software Developers
- 23:09What do we teach our Champions
- 25:11Secure Coding Architecture Design
- 26:43Policies
- 31:02Tooling
- 33:18Coaching
- 33:51What Coaching Means
- 34:58How to Do Coaching
- 37:16Delegation
- 38:19Not to Delegate
- 39:36Recognition and Rewards
- 40:24Importance of Recognition
- 40:43How can we recognize them
- 42:49Rewarding good behavior
- 43:34Security gifts
- 44:59Dont stop
- 45:36Planning
- 47:18Summary
- 48:14Free Resources
- 48:48Books
- 49:16Podcast
- 50:11Strange people
- 50:21Thank you
related talks
37mBuilding Security Champions
49mTransforming Security Champions
36mChampioning Security: Scaling Security at Every Level
27mSecurity Champions: The What, Why, and How
48mGrowing A Security Champion Program Into A Security Powerhouse
35mSDL at Scale: Growing Security Champions
32mBeyond training: Building a high-impact security champions program
32mSecurity Champions? Introduce them in your Organisation