Chris Romeo -- Security Community at Any Scale

How can a company build a security community when it has only a few interested people and little budget? Robert interviews Chris Romeo about lessons from growing an internal community at a large technology company and adapting those lessons to smaller organizations. Chris distinguishes security advocates from champions, explains how to recognize motivated contributors, and recommends a dependable rhythm of meetings and learning opportunities. They discuss lunch sessions, practical training, and the conditions that make an internal security conference worthwhile. Robert keeps the conversation grounded in what a small team can actually do, including learning from outside events and sharing that knowledge at work. The episode presents community as a sustained network of relationships that helps people learn and apply security together.The Application Security Podcast is brought to you by Security Journey.About Security JourneySecurity Journey provides application security education for developers and everyone in the software development lifecycle.→ Learn more about Security JourneyConnect with Chris Romeo:→ Chris Romeo’s presentationsMentioned in this episode:→ OWASP Top 10→ CSSLP (ISC2)→ Black Hat→ DEF CON→ All Day DevOpsFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 Building a security community at any scale01:19 What an internal security community does02:14 Starting with a few interested people10:09 Identifying security champions12:02 Establishing a monthly learning cadence13:53 Engaging more of the organization15:10 Choosing useful training and learning resources17:39 When to hold an internal security conference22:06 Learning from external events on a smaller budget