Tech Lead
Overview
The Tech Lead is the team's technical authority. They decide at the level where the decision still belongs to the team: they approve what the risk level assigns to them, close the threat model and answer for what goes into the code, including what was generated by assistants.
Not to be confused with the Scrum Master / Team Lead: the latter facilitates the team's process; the Tech Lead decides on the technical content.
Key Responsibilities
- Approve what the risk level assigns to them (L1 in classification; A1 in AI agent mandates)
- Take the final decision on the team's threat model (baseline and revisions)
- Review code and configuration generated with assistants before the merge
- Validate, with the Security Champion, that contractor access is limited to what is necessary
Organisational Context
Approval proportional to risk gives effect to the accountability that NIS2 and DORA ask for: the decision stays with whoever has the technical competence to take it, and moves up to AppSec Engineer and CISO as the risk rises.
Regulatory Framework
Supports:
- NIS2 and DORA: Technical decision that is assigned, recorded and proportional to risk
- AI Act: Human oversight (Article 14, for high-risk AI systems); in SbD-ToE extended to code and to the actions of AI agents (the Manual's choice)
Activities by Chapter
Ch. 01 - Application Classification
Propose the classification with the Developers and approve the inventory entry at L1; approval moves up to AppSec Engineer at L2 and to CISO at L3.
Ch. 02 - Security Requirements
Review requirements on critical changes, answer for code generated with assistants and classify and approve the autonomy level of AI agents.
User Stories:
- US-02: Review on relevant change - Requirements updated on critical changes (with Software Architects and Scrum Master / Team Lead)
- US-14: Controlled use of automated assistants - Generated code identified and reviewed (with Developer and AppSec Engineer)
- US-15: Classification and recording of the AI agent mandate - Approver for A1; co-approver for A2 and A3 (with AppSec Engineer)
- US-18: Intent declaration per destructive tool-call - Risky actions preceded by recorded intent (with AppSec Engineer)
Ch. 03 - Threat Modelling
Take the final decision on the model in the team's context and formally approve the baseline and the revisions.
User Stories:
- US-09: Formal approval of the Threat Model - Explicit and auditable decision (with AppSec Engineer)
- US-14: Independent review at L2 and PASTA at high risk - Review by someone outside the delivery team (with AppSec Engineer)
Ch. 10 - Security Testing
Receive escalations of triage conflicts and co-approve overrides at L3 (dual approval with AppSec Engineer).
Ch. 11 - Secure Deployment
Approve MEDIUM-severity exceptions; HIGH moves up to AppSec Engineer and CRITICAL to AppSec Engineer with Executive Management.
Ch. 13 - Training and Onboarding
Give the completion sign-off for contractor technical onboarding, which conditions real access (with AppSec Engineer).
Ch. 14 - Governance and Contracting
Validate the need for each contractor access and give post-project feedback.
User Stories:
- US-19: Quarterly review of contractor access - Least privilege maintained (with Security Champion and DevOps / SRE)
- US-20: Post-project feedback and contractor rating - Informed re-hire decisions (with Security Champion)
Chapter References
For full context and framing: