Being Powerful While Powerless: Elevating Security By Leading Without Authority
summary
A one‑person security role scales through code and relationships not titles: writing automation, running static analysis, managing vulnerable dependencies, and combining annual pen tests with an ongoing bug bounty program. Uses tools like danger and dependency scanners on Gusto code in AWS, leverages HackerOne researchers, and shifts security left into the PM and engineering flow. Outnumbered roughly 1 to 100–150, engineers triage and land fixes (two HackerOne reports got PRs within an hour), so cultural buy‑in plus automation produces measurable coverage.
AI-written summary · about
chapters (33)
- 0:00Introduction
- 0:46Being the only member of the security team
- 1:08What responsibilities I had
- 1:23How much work is involved
- 1:53What was up against me
- 3:38Technical strategies
- 4:01Push left
- 4:40Writing code
- 6:08Automating
- 7:24Code Analysis
- 8:37Vulnerability Management
- 10:46Pentesting
- 12:43Bug Bounty
- 13:48Cultural Strategies
- 14:15Key Stakeholders
- 17:17Everything is okay
- 18:04Be authentic
- 18:59Be accessible
- 20:58Teach different classes
- 22:54When all of this works
- 23:13Example
- 23:55Not clicking on phishing emails
- 24:37Working with engineers
- 25:59Its not easy
- 26:18Technical perspective
- 27:05Cultural perspective
- 27:34Being powerful while powerless
- 28:25Conclusion
- 30:08Does this work yet
- 31:24Dealing with conflict
- 33:49Premise or cloud
- 35:20Difficult players
- 37:41Managing priorities
related talks
48mGrowing A Security Champion Program Into A Security Powerhouse
24mBeing secure by design: Engineer-led security
27mSecurity Champions: The What, Why, and How
25mWhat Does it Mean to Build a Proactive Security...
51mBuilding Security Champions
36mChampioning Security: Scaling Security at Every Level
43mDeveloper Driven Security In High-Growth Environments
38mKeynote: Dumping Traditional Security Teams