Scaling Product Security with a Product Security Lead Program

### Overview In this talk, Brenna Leath, Senior Security Architect and former Head of Product Security at SAS Institute, presents a blueprint for scaling product security across large enterprise environments using a Product Security Lead (PSL) program. After the entire central product security team resigned in early 2021, Leath was tasked with supporting several thousand engineers across 14 business verticals and over 200 software products as the sole remaining security team member. Confronting market-wide talent shortages, high recruitment costs, and severe burnout, Leath opted against reliance on contractors or standard hiring and instead built a federated PSL model by sourcing and training internal talent into embedded security professionals.

### Key Topics - **The Target Operating Model & Federated Security:** Centralized security teams often lack visibility into divisional verticals and product silos. A federated model bridges the gap between central policy (the Product Security Office, or PSO) and engineering execution by establishing dedicated divisional leads. - **Differentiating PSLs from Security Champions:** Security champions remain embedded directly on feature teams to run scans, remediate code flaws, and handle day-to-day secure coding. In contrast, PSLs are senior individual contributors who report directly to divisional leadership and matrix into the PSO, handling division-wide strategy, architecture reviews, and stakeholder alignment. - **Candidate Selection & Internal Mobility:** Rather than hiring externally during a freeze, candidates were recruited internally from senior or principal positions across diverse disciplines, including technical documentation, project management, and quality engineering. - **Curriculum and Mentorship:** Because standard vendor training lacked dedicated application and product security focus, the organization developed multi-tiered training ranging from OWASP Top 10 fundamentals to professional certifications (CSSLP, CISSP), backed by weekly syncs, office hours, and open forums. - **Operational Testing & Real-World Validation:** The newly trained PSL team was tested during the Log4j crisis while Leath was on parental leave, successfully driving division-wide response and remediation without central bottlenecks.

### Technical Details - **Assessment & Maturity Frameworks:** Program planning leveraged structured maturity assessments using OWASP SAMM v2 (evaluating practices across its five core pillars) and BSIMM concepts to map gaps across 41 activities in the secure SDLC. - **Matrix Management Structure:** PSLs report administratively to divisional leadership while taking strategic direction, governance, and mentorship from the PSO. Time allocation is negotiated between central priorities (such as threat modeling, bug bounty scoping, and penetration testing roadmaps) and divisional priorities (such as CI/CD tooling migrations). Time tracking is used to measure effort expended on secure design reviews. - **Boundaries of the PSL Role:** The speaker explicitly defined role boundaries to prevent PSLs from becoming bottlenecks: PSLs do not run code scans for teams, do not clean up or patch code vulnerabilities directly (not a 'janitor'), and do not police release checklists (not a 'compliance cop'). Instead, PSLs define the 'what' and architecture guidance, while engineering teams execute the 'how'. - **Measurable Outcomes:** Establishing the program produced division-wide baseline reference architectures, lowered time-to-remediation during security incidents, and enabled over 25 staff members to achieve the CSSLP certification.

### Takeaways - **Shift Responsibility, Not Just Tools:** True DevSecOps requires engineering divisions to take ownership of product security rather than expecting the central security team to secure their code. - **Clarify Role Boundaries Early:** Distinguishing strategic roles (PSLs) from implementation roles (security champions, developers) prevents burnout and avoids misaligned expectations. - **Cultivate Internal Talent:** Tapping respected internal contributors with strong institutional knowledge and execution skills can overcome industry-wide security hiring shortages. - **Implementation Roadmap:** Organizations should spend the first week reviewing baseline posture via maturity models (e.g., OWASP SAMM); use the first 90 days to define the operating model and matrix structure; and spend months three through six working with HR on formal job descriptions, compensation bands, and onboarding curricula.