Chris Romeo -- Security Community at Any Scale

How can a company build a security community when it has only a few interested people and little budget? Robert interviews Chris Romeo about lessons from growing an internal community at a large technology company and adapting those lessons to smaller organizations. Chris distinguishes security advocates from champions, explains how to recognize motivated contributors, and recommends a dependable rhythm of meetings and learning opportunities. They discuss lunch sessions, practical training, and the conditions that make an internal security conference worthwhile. Robert keeps the conversation grounded in what a small team can actually do, including learning from outside events and sharing that knowledge at work. The episode presents community as a sustained network of relationships that helps people learn and apply security together.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo:
→ Chris Romeo’s presentations

Mentioned in this episode:
→ OWASP Top 10
→ CSSLP (ISC2)
→ Black Hat
→ DEF CON
→ All Day DevOps

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Building a security community at any scale
01:19 What an internal security community does
02:14 Starting with a few interested people
10:09 Identifying security champions
12:02 Establishing a monthly learning cadence
13:53 Engaging more of the organization
15:10 Choosing useful training and learning resources
17:39 When to hold an internal security conference
22:06 Learning from external events on a smaller budget