This may not be a very technical question per se, so please feel free to move it to the respective forum/stack. However, I would really appreciate anybody experienced or experiencing a similar situation and the solutions being adopted.
So, I am working as a security engineer with a small start-up. Now, in my previous organization, a typical corporate, I had my boss to take care of doing the convincing etc. with the top level management and getting the things required for us to work smoothly. However, in my current role, being a start-up, I am the only engineer responsible for the information security of the whole company. Now as overwhelming, as it gets, it is becoming an amazing learning curve for me by the day. I am picking up different aspects of security as baby steps, one at a time, starting off with the most important assets that need to be protected and that lie at the maximum risk/in the threat zone. I am trying to prioritize stuff and see where a pen test is needed and where is a VA needed.
There are many challenges that I am facing of which I would like to the discuss one below: Now given the above situation that I am in, one major challenge that I am facing as of now is that I constantly keep pushing by tech leads to make sure that every every new feature that I am supposed to test needs to first get QA verified before I can pick it up for a VA/PT/security testing. The reason being, there have been a couple of instances, where due to an incomplete QA on the feature, my security test cases gave false negatives, as the feature itself was broken contrary to the expectation. Now this is something that the tech leads are not finding convincing enough to allow security testing only after QA approval. They need more examples/test cases to support this Their argument being,
security test can be done in parallel to QA and that I need not really wait on the QA as it is simply pushing the release date un-necessarily.
Am I right in my argument ? If yes, what else can I possibly do to convince them on my points. If am not right, please help me understand why is my argument incorrect.