EP7 - Chaitanya Bhatt: How Credit Karma Scales Their AppSec Program

Credit Karma is expanding rapidly and a huge focus for them is having a truly agile engineering team. Application security has also been a focus and their ratio of appsec engineers to developers is 1-:50 which is one of the industries best ratios. 

In their movement to success, today's show shares exactly how Credit Karma’s Director of Application Security Chaitanya Bhatt has tackled modern application security. Chaitanya’s perspectives and expertise come from his first-hand experience in leading security teams at organizations including eBay, AppDynamics (acquired by Cisco), and Autodesk. 

Key Findings: 

• How enforcing security policies earlier in the software development lifecycle can make security easier for developers. 
• How to build an AppSec program that's capable of keeping up with the pace of software development.
• Why having an embedded partnership model between application security engineers and developers is critical — and how to logistically manage making this a reality.
• What most organizations get wrong with their security champions programs and how to make your program more impactful. 
• How to incentivize developers to invest their time and effort into security-related tasks. 
• Why shift-left is not enough, where building security-as-code comes into play.

Resources: Episode mentioned — Travis McPeak: Securing the Modern SDLC with Security