Scaling Product Security with a Product Security Lead Program
summary
After losing a central team, SAS builds a Product Security Lead program in ~90 days to place a trained security expert into each business vertical across 200+ products and ~4,000 R&D staff. Product Security Leads report to divisional leadership and matrix into the central office, run secure design reviews, own tooling POCs and incident response, mentor security champions, but do not run scans or act as compliance cops. The program handles Log4j, produces baseline architectures, cuts time to remediation and yields many certified practitioners.
AI-written summary · about
chapters (11)
- 0:00Introduction and background
- 3:36Why the program started
- 11:10Target operating model
- 21:23Federated model explained
- 24:17Roles and responsibilities
- 32:47Scaling product security
- 36:03Training and mentoring PSLs
- 41:02Defining success criteria
- 43:54Next phase and future vision
- 45:47Steps to implement the program
- 47:10Q&A session
related talks
27mSecurity Champions: The What, Why, and How
34mSecure Product Lifecycle (SPLC) as a Service
24mBeing secure by design: Engineer-led security
54mSDL at Scale: Growing Security Champions
51mBuilding Security Champions
35mSDL at Scale: Growing Security Champions
40mInfosec Makeover: Love it or Leave it, Product Security is Here to Stay
44mA Warrior's Journey Building a Global AppSec Program