Gamify security best practices to scalably improve engineering culture
summary
Internal Rails app Monocle aggregates GitHub, CircleCI, Jira and vulnerability data nightly, shows repositories graded A–F, and surfaces pull request checks via Open Policy Agent Rego rules; failing merges auto-create Jira tickets and post to team Slack channels. Deployment scales across a tripled engineering org, yields about 2,000 engineering hours a year saved on auditing, raises the percent of repos above a B, and makes security fixes discoverable and actionable without blocking developer workflow.
AI-written summary · about
chapters (9)
- 0:00Introduction to Monocle
- 1:15Security scaling challenges
- 2:51Gamification and grading
- 6:13Leadership visibility
- 7:24Risk advisor and automation
- 9:17Driving adoption via Slack
- 10:48Measuring impact
- 13:07Getting started
- 14:16Architecture and conclusion
related talks
45mHow Leading Companies Are Scaling Their Security
57mBuilding a Modern Security Engineering Organization
43mDeveloper Driven Security In High-Growth Environments
43mBuilding a Secure DevOps Pipeline
56mLeveling up an application security program
36mThe Road To Being Rugged
48mGamify your Security
11mLove Your Security Engineer as Yourself