Designing Product Security for a Brighter Smile and a Healthier Tomorrow
summary
Three years of queue-driven work converts into a hub-and-spoke integration-and-services model that assigns product security engineers as SMEs to pods, hands incident response to SecOps, and replaces PDF reports with security tickets inside the engineering defect system tied to each story. Work aligns to engineering OKRs via a point-based questionnaire, a skills matrix maps talent, and automation, lightweight threat models and paved paths create a self-serve layer. Result: planning-based quarterly backlog control, ~80% engineer capacity for development, and tighter product integration.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:31Introducing the Product Security team
- 3:09Challenges
- 11:59Skillset Matrix for the Team
- 13:28Engineer Assignments and Scope of Work
- 15:03Planning
- 16:41Point-Based Prioritization Framework
- 17:20Feedback Loop
- 18:43Security Assessment Methodology
- 21:34Open Communication
- 23:22Recap
- 24:31Observations
- 32:03Version 2 - Getting Better
- 35:15Version 3 - The Future
- 37:05Takeaways
- 38:59Applying Integration & Services Model in your Organization
related talks
24mBeing secure by design: Engineer-led security
43mDeveloper Driven Security In High-Growth Environments
57mBuilding a Modern Security Engineering Organization
38mKeynote: Dumping Traditional Security Teams
54mSDL at Scale: Growing Security Champions
01h 04mShifting Security Everywhere
47mSecurity is Everybody's Job
43mScaling Security through Context-Based Security Asses...