Skip to content
Playbook

What is a Security Champion?

Security work needs to scale with the number of teams and projects we have, and it has to be part of how we work every day, not something that happens once before launch. That’s why we want every team to have a Security Champion.

A Security Champion drives and motivates security work in their team. They help the team stay aware of security and act as the team’s security conscience. The team as a whole is still responsible for making sure security tasks are shared out and done. The champion’s job is to help the team hold itself to that.

You don’t need to be a security expert to become a Security Champion, but you should be interested in it. And remember: you’re not alone. The other Security Champions are there to help you, and you may be able to help them too.

Core activities

Section titled “Core activities”

As a Security Champion, you:

  • Help make security part of the team’s daily work, for example in planning, pull request review and when choosing new dependencies or services.
  • Build your own knowledge of security topics that matter for the team, and share it with the rest of the team.
  • Are the team’s point of contact for security. People outside the team (other teams, Customer Support, project managers) know they can come to you with security questions about the team’s systems.
  • Take part in the Security Champion network by sharing what you learn with the other champions and contributing to this playbook.
Section titled “Recommended practical activities”
  • Follow up on Dependabot alerts and pull requests for the team’s repositories, so they’re reviewed and merged instead of piling up.
  • Check that the team’s repositories follow the GitHub guideline: branch protection, minimum workflow permissions, pinned actions and a clean zizmor run.
  • Make sure the team’s systems are registered in Backstage with an owner, hosting and SLA information, so Customer Support and others can find them.
  • Keep an eye on secrets. Check that private repositories use gitleaks (see GitHub Advanced Security), and that leaked secrets are rotated.
  • Bring security into planning. When the team starts on a new feature or service, ask what could go wrong and use the Guidelines and the Golden Path as a starting point.

New to the role? See Getting started for concrete tasks to begin with.