Agile teams and security master role

Many companies develop with agile teams, like scrum teams. In the same time  security challenges lead to adding new members in the security team. Still,  the security of the code does not improve as requested.


The pure classical approach has a problem: Security and developer do not speak the same language and misunderstand frequently.  The results is silos- acting, isolation, finger pointing etc.

 The elegant solution is to build a security master in every developer team:

• Developer -  part of the team that can answer concrete engineering questions on daily bases
• Doted line report to security engineering  (20%-40% of yearly goes)
• Organic member – take an existing team member and build him to become security expert -    Security Trainings, Certification and Conferences etc.
• The Sec Master must not be: the worst coder that the team gladly will spare for security. He must be highly credible and respected.
• It has to report or escalate if serious security issues are coming in the developing

 Still, the you need:

• Security engineering department for security intensive projects, like Firewalls etc 
• Security Archotect
• Security Quality Assurance and IT Risk 
• Chef IT Security Officer 
• Security Operation
• all other security relevant departments, see ISO 27000 for more info 

How the organization is may look like, it is up to company. Here a simplified  example showing only some departments.