I work as an application architect at larger company that builds web applications using both .Net and Java technologies. These are sold to and accessed by other businesses (not consumers). We have multiple application development teams working on these, including various skill levels of employees, contractors/consultants and outsourced teams.
We have a mature Information Security group, data center operations, networking. etc. We also have mandatory application security training, scans of source code with third party software and guidance via security policies and procedures.
i’m trying to advocate for a smaller team (3-4 people) that could focus on detailed, code level implementation and remediation items from audits and scans. These individuals would understand how the OWASP Top 10 looks like in code and over the network, and not viewed as a management checklist.
Question: I’m looking for information about the right skill mix in building this team, preferring any documented case study, but opinions also hold value. I want to avoid a generic list like: Java developer, .Net developer, tester, DBA, etc.
Also, trying not to make this a subjective, open ended question - so would appreciate any recommended edits.