DevSecOps and Software Supply Chain
Security Champions Program
We assign a developer responsible for security in each development team and establish the role and working model. Security knowledge is retained within the teams that write the code.
What it is
A central security team cannot monitor every change in every team. A security champion is a developer who is the first point of contact for security questions in their team. They raise risks in design meetings, prioritize findings, and connect the team with the security team. The program documents the time allocated, training, and limits of responsibility for these individuals.
Scope
- Role definition, limits of responsibility, and allocated time
- Champion selection based on team and product risk
- Secure coding training specific to the languages and frameworks used
- Threat modeling and finding prioritization exercises
- Regular meetings and a communication channel between champions and the security team
- Metrics demonstrating the program's impact
The need
When organizations need it
- When development teams grow much faster than the security team.
- When PCI DSS requires staff developing custom software to receive secure software training at least every 12 months.
- When similar findings recur across teams and training is not reflected in the code.
Method
How we work
-
Design
We define the role, allocated time, and expectations together with your managers.
-
Launch
We select the initial group of champions and provide training using examples from your own code.
-
Practice
In the first months, we conduct threat modeling and finding prioritization together with the champions.
-
Handover
We transfer the regular meetings, communication channel, and program metrics to your organization.
Outcome
What you have at the end
Each team has a developer who is the first point of contact for security questions, with a defined role and allocated time. The program's impact on teams is tracked with metrics.
Frequently asked questions
Do champions replace the security team?
No. A champion is the first point of contact and link in their team. Decisions and verification requiring expertise remain with the security team.
How much time should be allocated to a champion?
This depends on the team size and product risk. What matters is that the time is documented and visible in sprint planning.
In which language and how is the training delivered?
Training can be delivered in Turkish or English. Examples are selected from the languages and frameworks your teams use, and from your own code where possible.
DevSecOps and Software Supply Chain
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting