WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2022 • Jun 15, 2022

Organizational Change Through The Power Of Why - DevSecOps Enablement

Nazneen Rupawalla

Why does application security constantly stall deployments? Learn how explaining the business context and empowering developer champions transforms security from a late-stage bottleneck into a seamless agile workflow.

Pause
Mute Enter Fullscreen
#1 about 4 min

Identifying bottlenecks in traditional software security approaches

Discover why centralizing secure development responsibilities within an infosec team creates friction and limited scalability.

#2 about 3 min

Establishing a center of excellence and security champions

How building a security center of excellence and establishing an empowered champions program drives cultural change.

#3 about 2 min

Embedding security controls into project management tools

Map security requirements directly into existing developer workflows utilizing standard issue tracking boards.

#4 about 3 min

Contextualizing the why and how of security requirements

Providing real-world threat context and specific implementation guidance helps developers understand the value of secure coding.

#5 about 2 min

Pairing with teams for continuous threat modeling

Mentor security champions in identifying system vulnerabilities using established threat modeling methodologies during product kickoff.

#6 about 2 min

Integrating security scanning tools early in the pipeline

Implement standard security tooling directly into the build and deployment lifecycle to prevent vulnerabilities from reaching production.

#7 about 3 min

Automating compliance tracking with customized project dashboards

Utilize simple scripting and webhooks to generate team-specific project boards and visualize real-time security progress.

#8 about 3 min

Visualizing organizational risks through a maturity model

Aggregate team-level security data into an overarching framework to facilitate meaningful discussions with governance forums.

#9 about 3 min

Nominating accountable security champions to drive adoption

Why asking technical leads to actively select members builds stronger accountability than relying on pure volunteers.

#10 about 4 min

Structuring implementation timelines and threat modeling cadence

Determine the time investment required to establish proactive security processes and establish cadence for threat modeling.

Matching moments

2:57 min

Securing team and management buy-in for DevSecOps adoption

Moataz Nabil Moataz Nabil · LIVE

5:25 min

Shifting left and creating internal security champion programs

Vandana Verma Sehgal · LIVE

2:09 min

Shifting security left using the DevSecOps approach

Aarno Aukia · LIVE

4:58 min

Scaling security teams through developer advocates

Tanya Janca · WWC 2021

48 sec

Scaling knowledge through security champions programs

Stefania Chaplin · WWC 2022

6:32 min

Embracing DevSecOps and automating the software development lifecycle

Mathias Tausig · LIVE

More from World Congress 2022

What the heck do "declarative" and "reactive" actually mean? thumbnail
30:40
almost 4 years ago

What the heck do "declarative" and "reactive" actually mean?

André Kovac

The Design and Evolution of C++ thumbnail
1:01:15
about 4 years ago

The Design and Evolution of C++

Bjarne Stroustrup

But, you're not Facebook thumbnail
31:12
about 4 years ago

But, you're not Facebook

Kristijan Ristovski

Communicate efficiently with Software Architecture Diagrams thumbnail
28:11
about 4 years ago

Communicate efficiently with Software Architecture Diagrams

Simon Lasselsberger

Get Ready for Jakarta EE 10! thumbnail
42:53
about 4 years ago

Get Ready for Jakarta EE 10!

Ivar Grimstad

Keep your code refactorable thumbnail
26:46
about 4 years ago

Keep your code refactorable

Gerrit Stapper

Upcoming sessions on this topic

Open session

World Congress 2026 North America

Practical Threat Modeling for Software Developers

Mudassir Syed

Lead Security Software Engineer

Mudassir Syed
Open session

World Congress 2026 North America

Your Threat Model Is Lying to You: Why Modeling the Design Isn’t Enough in 2026

Farshad Abasi

CEO/Founder, Eureka DevSecOps + Forward Security

Farshad Abasi
Open session

World Congress 2026 North America

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova
Open session

World Congress 2026 North America

Don’t kill my Vibes - Simple Steps to Stay Secure when Vibe Coding

Isaac Evans

Co-founder & CEO of Semgrep

Isaac Evans
Open session

World Congress 2026 North America

It passed auth, then production caught fire

Alex Olivier

Co-founder & CPO @ Cerbos | OpenID AuthZEN Co-chair

Alex Olivier

Related videos

DevSecOps culture thumbnail
16:00
WWC 2023 • almost 3 years ago

DevSecOps culture

Ali Yazdani

Secure Code Superstars: Empowering Developers and Surpassing Security Challenges Together thumbnail
23:34
WWC 2022 • about 4 years ago

Secure Code Superstars: Empowering Developers and Surpassing Security Challenges Together

Stefania Chaplin

Building Security Champions thumbnail
48:02
WWC 2021 • about 5 years ago

Building Security Champions

Tanya Janca

DevSecOps: Security in DevOps thumbnail
33:20
LIVE • almost 6 years ago

DevSecOps: Security in DevOps

Aarno Aukia

You can’t hack what you can’t see thumbnail
29:34
LIVE • almost 6 years ago

You can’t hack what you can’t see

Reto Kaeser

Security Pitfalls for Software Engineers thumbnail
27:32
WWC 2023 • almost 3 years ago

Security Pitfalls for Software Engineers

Jasmin Azemović

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.