EP 43 — Avalara’s Derek Samford on Building a Security Culture with Data, Collaboration, Education, and Empathy

In this episode of the Future of Application Security, Harshil speaks with Derek Samford, Senior Director of Product Security at Avalara, a company that builds cloud-based tax compliance solutions. They discuss Derek's approach to product security, including how his team uses data to drive visibility, how feedback loops can build maturity, and how they create application grade cards that inform remediation efforts. They also discuss how everyone is invited to contribute to product security solutions, how they create custom training for each new process, and the importance of empathy.

Topics discussed:

• How Derek's varied background brought him from network engineering to scalability and performance testing, to field support, to building a security validation team, to today building applications at Avalara from the ground up.
• Why empathy is the most important skill you can have in security, and why it allows you to help others do their best work.
• How Derek's team practically approaches security, from running the same tools developers do, to having a strong security champions program, to encouraging open feedback.
• How Alavara builds collaboration by inviting anyone who wants to contribute to security solutions to be part of the working group.
• How Alavara uses data to help them understand what they're protecting, to gain greater visibility, and to unify their processes.
• How standardized processes and feedback loops create maturity over time.
• The importance of education, and why they create training specific for the organization that focus on "our tools, our processes, and our recommendations around security."