Chris and Robert -- Security Champions

What is a security champion, and how can an organization build a program that lasts? Chris and Robert compare definitions, alternative titles, and the qualities that make a champion effective. They explain why interest and influence often matter more than formal authority, why champions can come from development, testing, product, or other roles, and how the network supports a secure development lifecycle. The conversation connects champions to security culture, two-way communication, and scalable expertise. It also covers program mechanics: role definitions, goals, training, recognition, management support, and a dependable operating cadence. Rather than treating champions as unpaid security staff, Chris and Robert describe a community that helps teams make better decisions while keeping responsibility shared across the organization.The Application Security Podcast is brought to you by Security Journey.About Security JourneySecurity Journey provides application security education for developers and everyone in the software development lifecycle.→ Learn more about Security JourneyConnect with Chris Romeo and Robert Hurlbut:→ Chris Romeo on LinkedIn→ Robert Hurlbut on LinkedInMentioned in this episode:→ Do you have Security Champions in your company?Follow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 All things security champions01:18 How the idea has evolved03:19 A programmatic definition05:40 Champions in the secure development lifecycle07:21 Alternative names and the meaning of champion10:06 Who makes an effective champion12:32 Start with genuine interest14:15 Influence across teams16:52 Champions as a driver of security culture18:57 Two-way communication and community21:04 Management support and recognition23:30 Role definitions, goals, and training25:05 Building a sustainable program