This document defines and outlines key stakeholders and their responsibilities.
This section details the various roles involved in the program and provides context for their duties.
The security team leader responsible for program strategy and execution.
Responsibilities
- Defines program goals and overall strategy.
- Determines program investments and prioritizes needs in collaboration with engineering leaders.
- Gains buy-in from engineering and security leadership.
- Defines and reports on metrics.
- Acts as a security point of escalation for security leadership/partners, engineering managers, or product managers.
- Incorporates feedback from engineering, product, and security stakeholders (e.g., security partners) into the partner program strategy and operational duties.
Acts as a security ambassador for product, engineering, and operations, serving as the primary point of contact for all security-related matters. Simplifies engagement with the overall security organization.
Responsibilities
- Determines the security support needed from an infosec perspective.
- Conducts security design reviews and threat modeling for products under development.
- Provides security mitigation guidance and remediation for supported products and teams.
- Assists with security scanning, penetration testing, bug bounty finding resolution, and vulnerability prioritization in collaboration with engineering.
- Directs product and engineering teams to compliance, privacy, and legal teams as needed based on risks or identified patterns.
- Assists engineering when vendor security reviews are needed, and ensures they are routed appropriately.
- Serves as a subject matter expert within security for a given product or feature.
- Assists engineering teams with security exceptions and risk acceptance, ensuring the technical accuracy of vulnerabilities and fixes while guiding stakeholders through the appropriate processes and contacts.
The engineering manager owns the development of products and features within the company.
Responsibilities
- Ensures the security partner is invited to key planning meetings, strategy sessions, sprint planning, and status check-ins (e.g., MBRs).
- Acts as a point of escalation for the security partner.
- Determines what security support is needed from their team's perspective.
- Listens to feedback from the security partner regarding team needs, which may include:
- Insights into vulnerability remediation and prioritization.
- Redirection to other security stakeholders as needed.
- Prioritizing proactive initiatives (e.g., considering new ideas from the partner for future exploration).
- Ideating technology or process enhancements to improve the security posture of their product.
- Serves as the Risk Owner for the products they manage without a product manager, acting as a key decision-maker for accepting risky product functionality.
- The primary stakeholder responsible for risk acceptance in a security exception or risk acceptance process.
The product manager defines product functionality, including requirements, and prioritizes what engineering builds.
Responsibilities
- Determines product vision and strategy
- Understand customer needs and competition
- Develops Product Requirement Documents (PRDs), which engineering uses to create Technical Design Documents (TDDs) and ultimately build and ship features.
- Prioritizes engineering work based on business objectives and goals.
- Serves as the ultimate Risk Owner for the products they manage, acting as a key decision-maker for accepting risky product functionality. They are the primary stakeholder responsible for risk acceptance in a security exception or risk acceptance process.
Document version 1.0 copied from Sectemplates.com 2025