I have recently joined the architectural review board (ARB) at the place where I work serving as the security representative. The role of the ARB is to recommend and approve software design specifications for projects approved by management. There are members representing development, QA and other aspects of the software delivery lifecycle on the ARB.

As I am the sole representative of IT Security on the ARB, , I frequently request the opinions of team members on security controls design, risk management, and compliance verification. However, team members have been reluctant to provide me with their opinions on what they think should be done. These are mostly engineers a fellow security professionals with around roughly 2-3 years of work experience. All team members know each other well and speak the same language - English. They complete assigned tasks well , just they are not open with opinions. I consider myself to be an open team lead / architect, hardly micromanaging and frequently stressing I am here to mentor rather than dictate. They respect me and in the past I have receive praise that my style of mentoring is very encouraging and effective.

As I take on a technical leadership role on the ARB, having team members to bounce ideas off of would be very helpful. Questions:

  • How can I encourage team members to be more willing and open to discussing their opinions of technical aspects our work? How can I help them be more comfortable in a consulting role?

  • If reluctance to opine, is due to lack of technical knowledge, at would point should they be consulted and how can I balance between challenging the team and recognizing the limits of their expertise ?

  • 2
    When you say 'team members' do you mean other members of the board,developers in the security team or developers in the architecture to be reviewed? – Helena Aug 18 '20 at 6:06
  • @Helena, team members refer to folks on my team – Anthony Aug 18 '20 at 12:29
  • So do these team members actually have knowledge they could be sharing? I think you need to figure that out before asking how to get them to provide said knowledge. – D. SM Aug 22 '20 at 3:03

2-3 years isn't very much experience, security tends to be an aspect of your work where you hope someone else's head is on the chopping block when a decision is made that turns out to be a bad one. Maybe you can run a workshop on a new application which doesn't have high security requirements and get each team member to craft their own prototype solution and then sit down afterwards and assess each other's work as a group

  • I work in the financial services industry so security is a essential aspect of all of our applications. There are many regulations and laws that we are subject to with non compliance being detected through regulators having serious consequences. – Anthony Aug 18 '20 at 12:31
  • 1
    I guess you haven't worked on very many different types of applications, some applications I have written require no security despite being a medical application. For example HL7 messaging engines can create gigantic security holes in medical systems, holes which are plugged by infrastructure configuration such as IP address whitelisting. I have also written interbank transfer software with no application security and like HL7 messaging the security is provided by the infrastructure. A similar situation exists when you write custom command line tools that are used in secure environments. – user120435 Aug 18 '20 at 13:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .