Lesson 3 / 31
Roles, Culture and Security Champions
Explain shared responsibility, the security champion model and how to make secure behaviour the easy default.
By Rahul Agarwal · 15 years in web development
Who does what
In a DevSecOps organisation, developers own the security of the code and services they ship: they fix findings, write tests for security bugs and follow secure defaults. The security team builds the paved road: vetted libraries, pipeline templates, scanning tools, policies, training and expert help for hard problems like cryptography design. Platform or operations engineers harden the infrastructure the code runs on. A security champion is a developer inside a product team who has extra security training and acts as the first point of contact: reviewing risky changes, triaging scanner findings and carrying lessons between teams. This scales better than one central team reviewing everything. Culture glues it together: blameless post-incident reviews, celebrating found bugs instead of punishing them, and measuring how quickly issues are fixed rather than how many are found.
Class representatives
A college cannot have a professor sitting with every student. Each class has a representative who knows the rules, answers simple questions and escalates the hard ones. Security champions play that role for each development team.
Paved road beats policy document
People follow the easiest path. A pipeline template with scanning already wired in, or a base image that is already hardened, changes behaviour far more than a forty-page policy PDF.
Quick check: What is the main job of a security champion?
- To be the only person allowed to approve deployments
- To run all penetration tests for the company
- To replace the central security team
- To act as a trained security point of contact inside a development team
Answer
To act as a trained security point of contact inside a development team — Champions are developers with extra security training who triage, review and spread practices within their own team.