Security Champions Programme
🌟 Objective
To establish a structured Security Champions programme in order to:
- Promote secure practices within the technical teams;
- Strengthen applied and continuous knowledge of security;
- Create a two-way channel between AppSec and development;
- Guarantee practical dissemination of security standards and culture.
🧬 What a Security Champion is
A Security Champion is a technical member of the team who acts as a local multiplier of security, with allocated time and the support of leadership. They are a practical reference, a facilitator of good decisions and the link between the ideal and the real context.
🎯 They are the link between principles and practice - with visible technical and cultural impact.
Champions play an active human role in the interpretation, application and dissemination of security practices, and are not replaced by automated mechanisms, even in contexts of high automation.
👤 Profile of a Champion
| Criterion | Description |
|---|---|
| Technical background | Solid knowledge of the team's stack |
| Interest in security | Genuine motivation (curiosity, previous experience, proactivity) |
| Available time | Typically 10–15% of the time (e.g. ½ day per week) |
| Recognition | Visibly appointed, with impact recognised and validated within the team |
🛠️ How to apply
🏗 Programme Structure
| Component | Description |
|---|---|
| 📋 Appointment | Voluntary or supported by the Tech Lead / PO |
| 🎓 Initial training | Track of 3 to 5 modules: threat modelling, dependencies, secure PR, etc. |
| 🤝 Champions community | Active internal channel, monthly meetings, sharing of practices |
| 📊 Impact metrics | No. of sessions held, bugs detected, feedback received |
| 📎 Institutional visibility | Internal page, badges, appointment in the technical rituals |
📋 Suggested backlog card
Title: [SEC] Nomear Champion para equipa "App XYZ"
Description:
Select and train a technical member of the team to act as Security Champion.
This person will support reviews, onboarding, threat modelling and the dissemination of practices.
Acceptance criteria:
- Appointment validated by the Tech Lead or PO
- Training track completed (LMS or verification by AppSec)
- Participation confirmed in the Champions community
🔄 Typical activities
| Type of action | Example |
|---|---|
| 1:1 or shadow session | Support a new dev in creating a secure PR |
| Assisted threat modelling | Run a session for a new feature or refactor |
| Sharing in the community | Publicise a PR with good security practices applied |
| Informal workshop | Mini-session: “Secrets in .npmrc: how and why to avoid them” |
✅ Good practices
- Guarantee explicit support from technical leadership (time and visibility)
- Promote active, not passive, communities of practice
- Use the champions as a maturity radar per team
- Link the training tracks to the champion role
📈 Success indicators
- ≥ 1 active Champion per product team or critical application
- Visible participation in the technical rituals (e.g. planning, retro)
- Monthly actions recorded (e.g. sessions, PRs, training)
- Positive feedback from the team on practical usefulness
- Reduction in recurring security errors after onboarding
📎 Cross-references
| Document | Relevance |
|---|---|
01-catalogo-formativo.md | Defines tracks and content for champions |
02-trilho-formativo.md | Applies the matrix proportionally |
10-checklist-onboarding.md | Champions help to guarantee secure onboarding |
90-indicadores-metricas.md | Champions influence training metrics |
🔒 Security culture is not born from a document; it is born from example.
Security Champions are the bridge between the ideal and practice, and must be supported with time, resources and institutional recognition.