Security Champion
Overview
Security Champions are local catalysts for security.
They do not replace AppSec, but bring security closer to the team's daily work, ensuring that good practices are followed and security stories are not ignored.
Key Responsibilities
- Act as catalysts for good practices in each team
- Reinforce adoption of the prescriptions close to daily work
- Ensure that security is not ignored in sprint planning
- Mentor and evangelise the team
Organisational Context
Facilitate the creation of a security culture - an element provided for in both NIS2 and DORA, which call for demonstration of training and awareness.
Regulatory Framework
Support the creation of the security culture required by:
- NIS2 and DORA: Awareness and continuous technical upskilling
Activities by Chapter
Cross-cutting - All Chapters
Help Developers and QA day to day, ensure that security checklists are followed, and make sure that security stories (requirements, threat modelling, fixes) are not ignored in the backlog.
Ch. 13 - Training and Onboarding
Mentor and evangelise the team in security practices. Lead threat modelling sessions per feature, epic or refactor.
User Stories:
- US-06: Threat modelling per feature/epic/refactor - The Security Champion leads the threat analysis (referenced as Developer in the lifecycle)
Ch. 14 - Governance and Contracting
Be the designated security owner for critical applications. Run the structured contractor preparation process, run secure offboarding, review access periodically (half-yearly at L1, quarterly at L2/L3), collect post-project feedback.
User Stories:
- US-05: Formal Security Champion appointment - Clear accountability (with Executive Management)
- US-11: Technical preparation of contractors - Ensure preparation before access (with HR / People Operations)
- US-12: Secure offboarding - Revoke access completely (with HR / People Operations / DevOps / SRE)
- US-15: Quarterly access review - Maintain least privilege (with Tech Lead)
- US-16: Post-project feedback - Inform re-hiring (with Tech Lead)
Chapter References
For full context and framing: