Skip to main content

Scrum Master / Team Lead

Overview​

The Scrum Master/Team Lead is the guardian of agile discipline.
The role ensures that security is not relegated to "when there is time" but integrated into the teams' daily planning and execution.

Key Responsibilities​

  • Facilitate the integration of security into the agile cycle
  • Remove blockers that hinder the implementation of secure practices
  • Promote discipline in applying review checklists
  • Moderate threat modelling sessions

Organisational Context​

Help operationalise the requirement for executive governance over digital security set out in NIS2 and DORA, ensuring that teams act according to defined processes.

Regulatory Framework​

Operationalises:

  • NIS2 and DORA: Implementation of executive governance over security practices
  • Translates organisational policies into concrete actions in the sprint

Activities by Chapter​

Ch. 01-02 - Classification and Requirements​

Facilitate discussions on criticality and requirements, ensuring that the whole team understands the risk context. Review the classification on critical integrations or relevant changes.

User Stories:

Ch. 03 - Threat Modelling​

Moderate threat modelling sessions, create the initial threat model with DFDs and STRIDE/LINDDUN, and ensure participation of the whole team.

User Stories:

Ch. 06 - Secure Development​

Ensure that every PR is reviewed against a mandatory security checklist, preventing vulnerabilities and keeping a compliance record.

User Stories:

Ch. 06-07 - Development and CI/CD​

Ensure that secure practices enter sprint planning, with a DoD that includes security criteria that can be validated.

Ch. 13 - Training and Onboarding​

Promote upskilling and continuous training, support a security culture, and remove impediments to learning time.

Chapter References​

For full context and framing: