Security Champions: Getting Engineers to Carry the Message

The security team numbers four. The engineering organization numbers two hundred and ships daily. Every design decision with a security dimension is made in a room the security team is not in.

That arithmetic never fixes itself by hiring. It fixes by multiplication: a champions program, where one engineer per team carries security into their own team's conversations - not as a second job, but as the person who knows when to raise a hand and whom to call.

Done well, champions make security a property of the engineering culture instead of a department that visits occasionally.

TLDR

• Champions extend security into rooms the security team will never enter.

• Recruit the willing; a conscripted champion is a mailing list with a title.

• Give champions real time, real training and a direct line to the security team.

• Their job is judgment and translation, not enforcement.

• Measure what changes in design decisions, not attendance at meetings.

What a champion actually does

The champion is the team's first security question: they spot the design session that needs a security opinion, translate the security team's requirements into the team's own vocabulary, and know the escalation path cold. They are not the team's police, and they are not accountable for the team's security - the team is.

The best champions are usually the engineers already doing this informally: the ones who ask about threat models in design reviews. The program finds them and makes the role legitimate.

Recruit willing people, then invest in them

Ask for volunteers, and take the engineers teams would miss. Champions need three investments: time that is real - a defined slice of their week, agreed with their manager; training that is specific - your stack, your threat model, your top risks; and access - a direct channel to the security team where a question gets an answer in hours.

Skip any of the three and the program becomes a title. Champions with no time stop attending. Champions with no training repeat slogans. Champions with no access stop asking.

Run it as a community, not a reporting line

This fictional example shows a program's working rhythm. It is an illustration, not a mandate.

Element	Cadence	Purpose
Champions sync	Monthly, 45 min	Share patterns, raise recurring friction
Threat-model walkthrough	Quarterly	Practice on one real design together
Feedback to security roadmap	Quarterly	What engineering needs from the security team

The last row is the one programs forget. Champions see where security requirements collide with how engineering actually works. That feedback, taken seriously, is how policies get written in the language of the people who must live with them.

Measure decisions, not meetings

Attendance is not the metric. The signs the program works: security questions raised earlier in design, fewer surprises in review, champions answering routine questions without escalation, and the security team learning about projects at the start rather than the end.

Expect the program to change what the security team does too. If the same question arrives from three teams, the answer belongs in a pattern, a template or a paved path - not in three separate reviews.

The related discussion of designing a DevSecOps culture is worth your time alongside this one. The related discussion of security as culture, not control is worth your time alongside this one.

Frequently asked questions

How many champions do we need?

Roughly one per engineering team, or one per ten to fifteen engineers. Start with three or four strong ones and let the model prove itself before scaling; a program of five engaged champions beats a directory of thirty names.

Does this replace security reviews?

No. It routes them. Champions handle the routine judgment calls in-team and pull the security team into the genuinely consequential decisions earlier, which is where review adds the most value.

How do we keep champions from burning out?

Protect the time allocation with their managers, rotate the heavy lifting, and recognize the work publicly. Champions programs die quietly when the role is all obligation and no growth.

A Defensible Next Step

Ask your security lead and engineering leads to name the people already playing this role informally. Invite three of them to be champions, with time and access attached. That is the whole launch. Book a Decision-Clarity Call if you want the charter.