Chris and Robert -- Security Champions

What is a security champion, and how can an organization build a program that lasts? Chris and Robert compare definitions, alternative titles, and the qualities that make a champion effective. They explain why interest and influence often matter more than formal authority, why champions can come from development, testing, product, or other roles, and how the network supports a secure development lifecycle. The conversation connects champions to security culture, two-way communication, and scalable expertise. It also covers program mechanics: role definitions, goals, training, recognition, management support, and a dependable operating cadence. Rather than treating champions as unpaid security staff, Chris and Robert describe a community that helps teams make better decisions while keeping responsibility shared across the organization.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ Do you have Security Champions in your company?

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 All things security champions
01:18 How the idea has evolved
03:19 A programmatic definition
05:40 Champions in the secure development lifecycle
07:21 Alternative names and the meaning of champion
10:06 Who makes an effective champion
12:32 Start with genuine interest
14:15 Influence across teams
16:52 Champions as a driver of security culture
18:57 Two-way communication and community
21:04 Management support and recognition
23:30 Role definitions, goals, and training
25:05 Building a sustainable program