The captain is the single person accountable for a security champions program. They convene the group, keep management support alive, and make sure the program survives people changing teams. The OWASP Security Champions Guide lists "nominate a dedicated captain" as its own principle, which tells you how often programs stall without one.
Why one name matters
Without a captain, a champions program becomes a shared inbox. Everyone assumes someone else is scheduling the meeting, chasing training budget or welcoming the new hire. Naming one person removes that ambiguity.
The captain is not the best engineer in the group and does not do the champions' security work for them. Their job is the program itself.
What the captain does week to week
- Runs a regular meeting with a short agenda: one topic to learn, one problem to solve, one thing to announce.
- Keeps a current list of champions per team and notices gaps.
- Brings requests from the security team to the group in one batch, so champions do not receive five separate asks.
- Brings champions' complaints back to the security team, such as noisy scanner results or an unclear policy.
- Tracks training and recognition so effort is visible to managers.
What the captain does less often
Once a quarter, the captain reports to the sponsoring manager. The report should be plain: which teams have champions, what the group worked on, what is blocked. Management support is a principle in the guide for a reason. It has to be renewed, not assumed.
The captain also plans for turnover. The guide lists anticipating personnel changes as a principle. In practice that means a written onboarding page, a buddy for each new champion and a standing rule that a departing champion nominates a successor before leaving.
Who makes a good captain
Look for credibility with developers first, security depth second. Someone who has shipped code and is comfortable saying "that finding is noise" will earn more trust than someone who recites policy. Communication and patience matter more than certifications.
If your security team is tiny, the captain can be a senior developer with a small slice of time, as long as a security lead stays available for escalations.
Failure signs
- Meetings happen only when the captain remembers.
- The captain is also the only person who triages findings.
- Champions hear from the program only when something is wrong.
- The sponsor has not heard about the program in two quarters.
Any of these means the captain role is understaffed. Fix it by cutting scope, not by asking the captain to work evenings.
A sample month for a captain
Week one: send the agenda and collect topics. Week two: run the meeting and write three lines of notes. Week three: follow up on actions and talk to two champions one to one. Week four: update the roster, check training progress and send the sponsor a two line status. That is roughly a few hours a week for a program of a dozen champions, which is why a fraction of one person's time is usually enough.
Quick check
Can the captain also be a champion on a product team?
Yes, in a small organization. Just protect their program time separately from their team work, or the program will lose every sprint planning argument.
How often should the group meet?
The guide does not set a number. Many groups find a short meeting every two weeks keeps the community alive without eating time. Adjust to your team's rhythm.
Sources
Last reviewed: 19 October 2026.
