“The security person should be up front and center and figuring out the security attributes of each one of those epics and/or business requirements and attaching them as part of the story or attachment as part of the epic, because then they will float down and they will make the life of the security champion a lot easier when they go through because they will see this metadata there and they will say, oh, well, the SME has already looked over this, and has figured this out that there's going to be a huge element of access control here.”

Transcript evidence from Geoff Hill — AppSec, DevSecOps, and Diplomacy.