Matt McGrath — Security coaches

Security programs improve when developers have someone who can help them want to get better, not merely tell them what they did wrong. Matt McGrath joins Chris and Robert to explain the security coach role and how it differs from both a wellness coach and a security champion. He describes the communication skills, technical credibility, and developer empathy that make coaching effective, then examines how coaching fits alongside training and other program controls. The discussion covers meeting cadence, part-time versus dedicated roles, measuring progress, and launching with a small group. Matt’s core advice is to partner with engineering teams and build their capability until they need less direct help from security.The Application Security Podcast is brought to you by Security Journey.About Security JourneySecurity Journey provides application security education for developers and everyone in the software development lifecycle.→ Learn more about Security JourneyConnect with Matt McGrath:→ Security Coaches episode pageMentioned in this episode:→ OWASP Security Champions GuideFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 Introducing security coaching02:20 Matt McGrath’s developer-to-security journey07:09 What a security coach actually does10:33 Helping developers choose to improve13:54 The security coach job description17:31 Communication, credibility, and technical skills20:42 How coaching feels from the developer side24:33 Working toward developer independence28:24 Part-time and dedicated coaching roles31:47 Choosing a useful coaching cadence33:59 Security coaches versus security champions38:31 How to launch a coaching program41:49 Partner with engineering teams