The road to developers' hearts

This talk looks at the friction that often arises when software engineers and security teams work on the same projects. The speaker, who has built security products since 2017 and worked on both sides, explains that differing priorities, tight deadlines and limited resources can turn small disagreements into escalations. The talk is organised around people, process, technology and culture.

On the people side, the speaker argues that trust grows when security staff are easy to reach and get involved early, through office hours, design reviews or a quick asynchronous channel. On process, early engagement helps, but heavy controls can slow prototypes, and a late audit that surprises teams breeds resentment. Security tooling is most useful when it is added to continuous integration and tuned to cut false positives, because noisy results cause developers to abandon it. Escalations go better when they come with a concrete mitigation plan and clear success criteria, and security groups should rank their requests ruthlessly so developers can see what matters most.

The closing section covers culture. Security changes can take a year or two of repeated reminders, so the speaker recommends finding allies inside development teams who will prompt security questions. Mentoring people and encouraging them to attend training and community events can influence an entire organisation. The talk ends with the speaker's own path into security, which began with a mentor.