Security champion
A developer or engineer on a product team who takes on part-time security responsibilities, such as threat modeling, triage and review, and links the team with the security group. A program needs protected time, training and outcome measures to work (OWASP Security Champions Guide).
- Defined in
- OWASP Security Champions Guide
Covered in
Run a security champions program with protected time and outcome metrics
Put a trained engineer with protected hours in every in-scope team, write the role into a one-page charter, route sensitive changes and findings through champions and AppSec, and judge the program by coverage and outcomes instead of attendance.
Run an AppSec program: owners, finding states, deadlines and champions
Translate a security baseline into service ownership, change triggers, reusable patterns and evidence that work reaches deployment.
Build an application security career: roles, skills, portfolio and certifications
The main application security role tracks (AppSec engineer, product security engineer, security champion, platform security engineer, security architect), the skills expected at each level, how to build a portfolio a hiring team can verify using this site's labs, projects and fix cards, and what common certifications do and do not show.