A security champion is a developer in a product team who acts as the link to the security group. In a typical week they spend a protected block of time triaging security defects, joining reviews, attending a briefing and answering teammates' questions. They are not a part time security engineer.
Definition
OWASP SAMM describes the level 1 champion as a liaison between information security and developers who gets protected weekly time for security work, joins periodic briefings, receives extra training, helps verify and prioritize security defects, and takes part in risk, threat and architecture reviews. NIST SSDF also lists security champions among the roles an organization may define.
A sample week
The numbers below are an illustration, not a standard. SAMM says the time should be protected and weekly but does not say how many hours, so set your own and write it down.
| Day | Activity | Rough time |
|---|---|---|
| Monday | Review new security findings for the team's services and mark real, false or unclear | 45 minutes |
| Tuesday | Join a pull request review where a change touches authentication, data access or secrets | 30 minutes |
| Wednesday | Attend the champions briefing; bring one question from the team | 30 minutes |
| Thursday | Pair with a teammate on a fix or a threat model for a new feature | 45 minutes |
| Friday | Update the team's notes: recurring issues, lessons, one thing to teach next week | 15 minutes |
That is about three hours. Many teams will find two to four workable. If your champions cannot find the time, the program is already in trouble.
What the work looks like in practice
Triage. The champion knows which services are internet facing, which hold personal data, and who owns what. That context makes findings easier to sort than any central team can manage. Our post on who should triage SAST findings covers the split.
Review. The champion looks at the changes that matter most, not every pull request.
Teaching. A five minute explanation in stand up beats a slide deck. When a finding repeats, the champion turns it into a short note or a lab for the team.
Escalation. If something looks serious, the champion knows how to reach the security group quickly and what to include.
What not to assign
- Owning every vulnerability for the team. Developers still fix their own code.
- Being the sole reviewer for security changes. That creates a bottleneck.
- Running the scanner tool. Platform or security staff should own tooling.
- Policing colleagues. Champions work well as helpers, not auditors.
Make the week visible
Put the protected time on the calendar and in the manager's goals. Count it as work, not extra credit. Without that, weekly time disappears the first time a release slips.
Where Safeguard fits
Safeguard provides vulnerability and dependency scanning with reachability analysis, which gives champions a sorted list to triage. A free scan shows what that looks like.
Quick check
Is a security champion a full time role?
No. It is a part of a developer's job with protected time. Full time security staff sit in the security group.
Does a champion need a security background?
Interest matters more than a background. Extra training is part of the role, so start with curiosity and build skills.
Sources
- OWASP SAMM, Stream B Organization and Culture
- NIST SP 800-218, Secure Software Development Framework version 1.1
Last reviewed: 19 October 2026.
