From Security Champion to Engineering Security Culture: MTS Web Services Transforms DevSecOps Approach

MTS Web Services has moved away from the traditional Security Champion model toward an engineering-wide security culture that embeds DevSecOps practices into everyday work. Head of DevSecOps Ilya Sharov and DevSecOps Lead Nikolay Luzgin described the transformation in detail, explaining how the company addressed overload, shallow training, and lack of motivation that plagued the earlier program.

How the original Security Champion program operated

The company first secured internal approval, created a wiki space, and established rules requiring exactly one champion per team. Managers had to approve the additional workload, and champions were selected or appointed based on interest where possible. Entry barriers were kept low with basic DevSecOps training, and a helper system allowed champions to escalate findings to experts for triage of true versus false positives. Motivation came through internal currency redeemable for merchandise and badges, while playbooks clarified responsibilities during vulnerability handling.

Problems that emerged

Over time the single champion became the default contact for every security question, leading to role overload and diluted focus. Basic corporate courses proved inadequate for deeper skill growth, and appointed champions showed little desire to advance beyond minimum requirements. Teams also lacked clarity on exactly which security topics to learn, whether infrastructure controls or secure coding techniques.

Changes introduced

The company replaced the single-champion structure with multiple security heroes who voluntarily deepen expertise within their primary roles. A DevSecOps guild was formed inside the larger engineering community, supported by community managers who organize events. Regular activities now include meetups, workshops, case studies, and feedback sessions; the number of such events grew from a few in 2023 to 18 in 2025.

Security scan results are now visible to entire teams and tied to maturity metrics. A short DevSecOps onboarding course introduces new employees to existing tools and processes. Competency maps define role-specific tracks for developers, DevOps engineers, architects, and managers, with quarterly updates to materials and external courses adapted to internal terminology. Recognition programs highlight both individual heroes and top-performing teams, while basic training completion is linked to key performance indicators.

Results achieved

Engagement has grown organically as specialists pursue security skills for professional value rather than obligation. Product teams increasingly include secure development topics in their own events, and the topic has moved from a localized initiative to a sustained engineering practice across the organization.