Geoff Hill — AppSec, DevSecOps, and Diplomacy

Why can a technically sound DevSecOps initiative fail before it changes how anyone works? Geoff Hill joins Chris and Robert to discuss the diplomacy behind application security transformation. He describes security as an activity throughout delivery, not a product bolted onto a pipeline, and shares lessons from tool integration and organizational resistance. The conversation moves from security champions to the managers who control their time, showing why persuasion, listening, and political capital matter. Geoff explores the fears underneath resistance, including job security and breaking working systems, and the danger of moving faster than an organization can absorb. He closes with practical starting points: understand the existing workflow, establish repeatable development and deployment practices, and introduce security through achievable improvements.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Geoff Hill:
→ LinkedIn

Mentioned in this episode:
→ Veracode
→ Ansible
→ Splunk

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
02:00 Defining DevSecOps across the lifecycle
04:57 Making security native to delivery
07:19 Lessons from failed integrations
12:17 Security champions and management support
16:34 Diplomacy, persuasion, and political capital
18:54 Listening before proposing change
20:16 Transformation in nonagile organizations
25:44 The fears behind resistance
29:46 Removing barriers through practical experiments
32:59 First steps toward a working pipeline