How To Be An Impactful Security Champion Mentor

The goal of the AppSec community is to promote a cooperative atmosphere among developers by providing coaching and mentoring, ultimately reigniting enthusiasm across industries.  

A security champion mentorship program is a great way to support your application security program. Tenured AppSec professionals and experienced security champions can share their knowledge to guide the next generation. 

In this article, we’ll dive into security champion mentorship, qualities, and expectations. 

When Security Champions Need Mentors 

In an ideal world, learners who reach Level 4 within their programmatic AppSec education program would be assigned mentors to evaluate their activities and provide constructive feedback for improvement.  

The most qualified mentors for this task would be individuals who have completed Level 4 and are working on their Level 5 learning paths. These mentors possess the necessary experience to guide and offer the best feedback to their peers. Mentoring can also help the mentors earn credit and experience as security mentors during their Level 5 path.  

Let’s look at the qualities to look for in influential security champion mentors and the expectations of a mentor with their mentee. 

Qualities of an Effective Security Champion Mentor 

When looking for effective security champion mentors, it is best to start within your organization. As a program administrator, you’ll have access to training history and the ability to reach across teams to bring mentors and mentees together. 

Here are some qualities you should look for when evaluating potential security champion mentors: 

Look For Someone with Experience in Software Development 

The individual who will mentor the security champions should have some experience in software development. This person should understand developers' challenges and the processes involved in developing software. 

Look For Someone with Experience in Security 

The individual should also have experience in security. They should understand security concepts, vulnerabilities, and common attack methods well. They should also have experience in implementing security measures. 

Look For Someone Who Can Communicate Well 

Communication is vital in mentoring. The individual should be able to explain complex security concepts in a way developers can understand. They should also be patient and willing to listen to the concerns of the developers. 

Look For Someone Passionate About Security 

The mentor should be passionate about security and understand the importance of security in software development. In addition, this person should be committed to helping the security champions succeed in their roles. 

Look For Someone Who Is Respected in The Organization 

The individual should be respected by the developers and have a good reputation. This will help ensure that the developers take the security champions' role seriously and are willing to work with them. 

Look For Someone with Availability 

The mentor should have enough time to dedicate to mentoring the security champions. They should be available to answer questions, provide guidance, and review activity submissions. 

Look For Someone Willing to Learn 

The mentor should also be willing to learn from the developers. They should be open to feedback and willing to adapt their approach to mentoring based on the needs of the developers. 

Expectations of a Security Champion Mentor  

After determining the qualities of an ideal mentor for security champions, it's crucial to establish clear expectations for them. This should be done during recruitment to ensure their effectiveness and commitment to the program in the long run. 

Read More: 4 Examples of Security Champion Activities  

Here are some expectations for mentors on how they can support the security champions with their activities:  

• Review Activity Submissions - Review the activity submissions from the security champions to ensure they align with the organization's security goals and objectives. 
• Provide Feedback - The mentor should provide feedback on the quality of the activity and the supporting documentation, as well as on the security impact of the activity.  
• Encourage Reflection - Encourage the security champion to reflect on their activity and to identify areas where they could have done better or where they could have added more value.   
• Provide Coaching - Provide coaching to the security champion on improving their skills and knowledge in security and software development. This coaching can include recommendations for additional training, resources, or best practices to help the security champion become a more effective security champion.   
• Celebrate Successes - Positive feedback is an integral part of the process. Ensure the learners know when they are doing high-quality/impactful work.  
• Evaluations - Evaluate the quality of the supporting documentation, such as reports, presentations, or code snippets, to ensure that it is clear, concise, and accurate. When assessing an activity's quality, the mentor should ensure that the activity has a well-defined objective and is aligned with the organization's security objectives.  

Mentorship is Key for Security 

Enhancing application security within your organization can be achieved by implementing a Security Champion program. These champions serve as security ambassadors and are recognized as experts among developers.  

By providing them with training and mentorship in secure coding, organizations can make significant investments in application security.  

To stay informed about the latest application security trends and Security Champions programs, tune in to 'The Security Champions Podcast' hosted by Michael Burch of Security Journey.