Project · Advanced · about 16 hours
Design and pilot a security champion program
Design a program that spreads security ownership into engineering teams, pilot it with one team, and measure whether it changed behaviour.
Skills:Application security, Communication, Stakeholder management, Threat modelling
Brief
Security does not scale by hiring more security engineers; it scales when product teams own it. Design the program that makes that happen and test it on one team.
What to build
Interview two or three engineers about where security currently slows them down or gets skipped
Design the program: what a champion does, the training path, rituals (threat-modelling in design, a secure-coding checklist in reviews) and the metrics you will watch
Create the pilot materials: a short threat-modelling guide, a secure-coding checklist and a lightweight security review step
Run the pilot with one team for a few weeks and measure before and after (findings caught in review, threat models done, time added)
Write the report: outcomes, feedback, and a plan to scale or change
Deliverables
Repository or document set with the program design, materials, pilot data and
REPORT.md
How it is graded
Reviewers assess whether the metrics show real behaviour change and whether the materials would work in their own team.
Stretch
Add a simple scorecard that rates each team's security practices and tracks it over time.
Deliverables
- [object Object]
- [object Object]
- A pilot with one team, with before-and-after measurements
- A report with what worked, what did not, and a plan to scale
How a reviewer grades it
| Criterion | Weight | What good looks like |
|---|---|---|
| Program is realistic and tied to measurable outcomes, not just training hours | 30% | |
| Materials are practical and usable by non-security engineers | 25% | |
| Pilot is measured with real before-and-after data | 30% | |
| Report is honest and the scale-up plan is credible | 15% |