# Roles, Culture and Security Champions — DevSecOps

Source: https://www.skillbyai.com/en/devsecops/dso-roles-culture

> Explain shared responsibility, the security champion model and how to make secure behaviour the easy default.

## Who does what

In a DevSecOps organisation, **developers** own the security of the code and services they ship: they fix findings, write tests for security bugs and follow secure defaults. The **security team** builds the paved road: vetted libraries, pipeline templates, scanning tools, policies, training and expert help for hard problems like cryptography design. **Platform or operations engineers** harden the infrastructure the code runs on. A **security champion** is a developer inside a product team who has extra security training and acts as the first point of contact: reviewing risky changes, triaging scanner findings and carrying lessons between teams. This scales better than one central team reviewing everything. Culture glues it together: blameless post-incident reviews, celebrating found bugs instead of punishing them, and measuring how quickly issues are fixed rather than how many are found.

## Class representatives

A college cannot have a professor sitting with every student. Each class has a representative who knows the rules, answers simple questions and escalates the hard ones. Security champions play that role for each development team.

## Paved road beats policy document

People follow the easiest path. A pipeline template with scanning already wired in, or a base image that is already hardened, changes behaviour far more than a forty-page policy PDF.

**Quiz:** What is the main job of a security champion?

- [ ] To be the only person allowed to approve deployments
- [ ] To run all penetration tests for the company
- [ ] To replace the central security team
- [x] To act as a trained security point of contact inside a development team

*Answer:* To act as a trained security point of contact inside a development team. Champions are developers with extra security training who triage, review and spread practices within their own team.