Nazneen Rupawalla

Organizational Change Through The Power Of Why - DevSecOps Enablement

Is your security team a bottleneck? Learn a data-driven strategy to shift security ownership to developers and explain the 'why'.

Organizational Change Through The Power Of Why - DevSecOps Enablement
#1about 3 minutes

Why traditional security engagement creates bottlenecks

Security teams become a bottleneck when accountability is misplaced and feedback is provided too late in the development cycle.

#2about 1 minute

Creating a center of excellence for security

A center of excellence was established to make security planning scalable, measurable, and easier for teams to adopt.

#3about 3 minutes

Integrating security into existing team workflows

A security champion program and mapping controls into project management tools like Trello helps embed security into daily work.

#4about 4 minutes

Structuring security controls with the power of why

Each security control is framed with a 'why' to provide business context and a 'how' with actionable steps and tools.

#5about 3 minutes

Automating security tooling within the SDLC

Security tools for SAST, runtime security, and cloud misconfigurations are integrated into the CI/CD pipeline as acceptance criteria for controls.

#6about 2 minutes

Visualizing security progress with data-driven dashboards

Data from Trello boards is automatically collected via webhooks to create dashboards that track team progress on security controls.

#7about 3 minutes

Creating a security maturity model for leadership

Team-level data is aggregated into a high-level security maturity model to give leadership visibility and drive accountability.

#8about 1 minute

Building an effective security champion program

Nominating champions through tech leads, rather than relying on volunteers, increases the program's impact and motivation.

#9about 1 minute

Key takeaways for building a security culture

Explaining the 'why' behind security empowers teams to take ownership, while relationship building and automation are key to cultural change.

#10about 3 minutes

Q&A on program implementation and threat modeling

The discussion covers the program's 1.5-year implementation timeline, managing high-impact risks, and doing threat modeling every iteration.

Related jobs
Jobs that call for the skills explored in this talk.

Matching moments

Why security teams must scale through developer collaboration
00:03 MIN

Why security teams must scale through developer collaboration

Building Security Champions

How to shift left with a security champions program
1:23:29 MIN

How to shift left with a security champions program

Stranger Danger: Your Java Attack Surface Just Got Bigger

Why security is a shared responsibility for every role
16:02 MIN

Why security is a shared responsibility for every role

What The Hack is Web App Sec?

Shifting security left with collaborative threat modeling
24:17 MIN

Shifting security left with collaborative threat modeling

We adopted DevOps and are Cloud-native, Now What?

Fostering a developer-first security culture
28:01 MIN

Fostering a developer-first security culture

Walking into the era of Supply Chain Risks

From vulnerability researcher to automated security founder
00:03 MIN

From vulnerability researcher to automated security founder

The transformative impact of GenAI for software development and its implications for cybersecurity

Scaling AppSec teams by empowering developers
15:05 MIN

Scaling AppSec teams by empowering developers

Why Security-First Development Helps You Ship Better Software Faster

The cultural shift from DevOps to DevSecOps
00:17 MIN

The cultural shift from DevOps to DevSecOps

You can’t hack what you can’t see

Featured Partners

Related Videos

See all videos
DevSecOps culture16:00

DevSecOps culture

Ali Yazdani

Building Security Champions48:02

Building Security Champions

Tanya Janca

Secure Code Superstars: Empowering Developers and Surpassing Security Challenges Together23:34

Secure Code Superstars: Empowering Developers and Surpassing Security Challenges Together

Stefania Chaplin

Real-world Threat Modeling21:54

Real-world Threat Modeling

Ali Yazdani

Simple Steps to Kill DevSec without Giving Up on Security21:53

Simple Steps to Kill DevSec without Giving Up on Security

Isaac Evans

Unleashing the Power of Developers: Why Cybersecurity is the Missing Piece?!?27:36

Unleashing the Power of Developers: Why Cybersecurity is the Missing Piece?!?

Tino Sokic

Why Security-First Development Helps You Ship Better Software Faster22:18

Why Security-First Development Helps You Ship Better Software Faster

Michael Wildpaner

Security Pitfalls for Software Engineers27:32

Security Pitfalls for Software Engineers

Jasmin Azemović

Related Articles

View all articles
AG
Andre Braun, GitLab
Now is the time for industrialized software development
Now is the time for industrialized software development Recently, I received a letter from my car’s manufacturer alerting me to a recall. They had discovered a defective part and wanted to replace it. It was easily fixed, and I might have forgotten a...
Now is the time for industrialized software development
BB
Benedikt Bischof
Building Security Champions
Welcome to this issue of the WeAreDevelopers Dev Talk Recap series. This article recaps an interesting talk by Tanya Janca who gave advice about how to find and teach the perfect persons to be your security champions. What you will learn:‍- How to at...
Building Security Champions
JC
Jordan Cutler
A Guide to Public Speaking For Software Engineers
“Your technical skills are where they need to be, but you need to improve your communication.” - Your manager. This is one of the hardest pieces of feedback to hear as a software engineer. Why? Because you probably thought as a software engineer you ...
A Guide to Public Speaking For Software Engineers

From learning to earning

Jobs that call for the skills explored in this talk.