How to Structure a Security Team (Embedded, Central, Hybrid)

Why this matters

How you structure the security team determines what gets shipped. Central security teams produce policies; embedded security engineers ship features. The mature model is hybrid: a central CISO + policy team, plus per-product-team security engineers who own that product's threat model. Pure-central orgs ship slowly; pure-embedded ones lack consistency.

Demo

Recommendation: for any fintech past Series B, run a hybrid model. Central team owns policy + IR + compliance + crypto/key infrastructure. Embedded engineers (~1 per 10 product devs) own per-team threat modelling + secure design review + bug triage. CISO reports to CEO, not CTO (avoids 'security blocks shipping' conflicts).

Try it yourself

1. Try to hack the org: ask 5 product engineers what their team's most recent threat model says. If <3 know, the embedded model isn't working.
2. Map your security org to one of: central / embedded / hybrid. Identify the gap.
3. Read Stripe's, Plaid's, Robinhood's published security org descriptions. Compare to yours.

References

• BSIMM — Building Security In Maturity Model
• SAFECode — Practical Security Stories