Security Stewardship

Every user, service, and integration that touches the system needs a clear answer to three questions: who is this, what are they allowed to do, and how long does that permission last. We design authentication flows around current standards (OAuth 2.0, OIDC, SAML where appropriate) and apply role-based or attribute-based access control with least privilege as the default. Session management, multi-factor requirements, and service-to-service credentials are documented so the model can be inspected rather than inferred from code.

A system-level security strategy is more than a collection of controls. It names the threat model the system is defending against, the assets that matter most, and the tradeoffs the organization has chosen to accept. We document that strategy explicitly so architectural decisions downstream can be traced back to it. When the threat landscape changes or the business scope expands, the strategy is updated in one place rather than rediscovered in every review. This sub-discipline sits at the boundary with Operational Stewardship, where WAF oversight, vulnerability scanning, and infrastructure hardening live.

Data governance starts with a map: what data the system holds, where it came from, how sensitive it is, who is allowed to see it, and how long it is kept. From that map we define storage locations, retention schedules, encryption at rest and in transit, and the approval paths required to change any of those rules. We treat the governance model as a first-class artifact, maintained alongside the code, so new features have a clear place to fit rather than introducing quiet exceptions.

Periodic security audits verify that the system’s actual behavior still matches its stated posture. Our audits cover access reviews, dependency and vulnerability scanning, configuration drift checks, and targeted code review of security-sensitive surfaces. The output is a written report with findings ranked by risk, reproduction steps, and concrete remediation recommendations. We design audit cadence around system change velocity rather than a fixed calendar, so fast-moving systems get more frequent reviews than stable ones.

Privacy is its own discipline inside security, not a side effect of it. We treat data minimization, purpose limitation, consent handling, retention, and data subject rights as design constraints that shape the system rather than checkboxes applied at the end. Where privacy regimes overlap or conflict across jurisdictions, we document the resolution so engineers inherit a decision rather than a dilemma. Formal compliance and regulatory alignment belong to Business Stewardship; this sub-discipline is where those requirements become technical reality.

The humans who build, operate, and use the system are part of its security posture. Security Training Oversight is not about delivering training ourselves, it is about making sure the engineering team and the operating team have current, role-appropriate training and that the training content matches how the system actually works. We help define what each role needs to know, verify that training is in place, and flag gaps where documentation and real practice have drifted apart.