Ask HN: How do you integrate corp security/risk people into agile projects?
Code&#x2F;PR reviews (by other devs and by people who specialize in application security), static analysis, secure coding practices training, constant vulnerability assessments and penetration testing, and a strong security team who understands the need to balance productivity and security.<p>Really, above all else it&#x27;s just hiring or contracting (ideally hiring) good security people. Good appsec people to review code and look for vulns, people who just do education and training, people who just do penetration testing, people who just do security architecture and tooling. And of course a good security operations and incident response team to deal with the day-to-day &quot;frontline&quot; defense, investigation, and response. If they are full-time employees who are integrated with the company culture and are experienced enough with agile development, then odds are they&#x27;re not going to set up more red tape than is necessary.<p>If security is mostly offloaded to devs or operations and no independent security org exists at your company, you&#x27;re in trouble.