Start with volunteers, because interest predicts staying power, then fill the gaps with a manager's nomination that the person can decline. A team with no volunteer still needs a named champion under SAMM level 1, so plan for that case rather than leaving it empty.
The two routes compared
| Route | Strength | Risk | Use when |
|---|---|---|---|
| Volunteer | Motivated, tends to stay | May cluster in a few teams | You are launching and want early wins |
| Nomination | Covers every team | Can feel like extra duty | A team has no volunteer after two weeks |
| Rotation | Spreads knowledge | Churn, shallow depth | Large teams, low risk services |
| Security team picks | Fast | Resentment, poor team fit | Rarely a good idea |
What to look for
None of these is a test; they are signals.
- Curiosity about how things break.
- Credibility with peers: people already ask this person for review.
- Time that a manager will actually protect.
- Willingness to explain without lecturing.
- A stable role, so they will still be there next quarter.
Seniority is not a requirement. A mid level developer who enjoys the work often outlasts a senior one who took the job out of obligation.
How to invite
Send a short message to engineering leads: what the role is, how much weekly time, what the person gets (training, access to the security group, recognition) and how to opt in. Give a deadline of two weeks. Say plainly that it is not a performance trap.
OWASP's guidance for champion programs includes the principles "Trust your champions" and "Secure management support" among its ten. Both matter here. A champion who is trusted but whose manager has not agreed to the time will drift away.
When nobody volunteers
- Ask the engineering manager to suggest two names.
- Talk to each person. Let them say no.
- If no one agrees, run the role as a short rotation, such as one quarter each, with a handover note.
- Meanwhile, the security group covers that team with a monthly check in.
Avoid these mistakes
- Choosing the least busy person. Low workload is not a signal of fit.
- Choosing only from one function. Include mobile, data, platform and front end teams if you have them.
- Skipping the manager conversation.
- Forgetting a successor. Anticipating personnel changes is another of OWASP's ten principles.
Where Safeguard fits
Safeguard provides asset discovery and dependency scanning, which can show you which teams own the riskiest code when you decide where champions are needed first.
Quick check
Can a manager be a security champion?
Possible, but the role is hands on with code and defects. A tech lead can work, a manager with no code time usually cannot.
How long is a champion's term?
OWASP does not set one in the pages reviewed. A common choice is a year with an option to renew. Write it down so people can step out gracefully.
Sources
Last reviewed: 19 October 2026.
