A tailored course, built for your situation
Mastering OWASP for Project Managers Delivering Secure Digital Services
Build trusted, audit-ready security outcomes into project execution from design to deployment
$199 one-time
24-hour access provisioning
30-day money-back guarantee
Hand-built implementation playbook
12 modules. 12 chapters per module. 144 chapters total.
12 modules, each with 12 chapters (144 chapters total), text-based, plus downloadable templates and a hand-built implementation playbook delivered alongside course access.
Spending cycles reconciling security feedback after development is complete
The situation this course is for
Projects stall when security is an afterthought. Developers rebuild, budgets bleed, and trust erodes when compliance gaps surface late. The cost isn’t just time, it’s credibility.
Who this is for
Project Manager in public sector or regulated environment leading digital service delivery, accountable for on-time, audit-ready outcomes
Who this is not for
Developers seeking code-level OWASP implementation, or executives wanting strategic risk overviews
What you walk away with
- Produce OWASP-aligned project documentation accepted without senior review
- Lead cross-functional teams through security sign-off without external facilitation
- Respond to regulator-facing review requests with pre-built, source-backed evidence packs
- Own the end-to-end vendor security review track for SaaS and third-party integrations
- Ship the first internal working proof of OWASP compliance within 30 days of deployment
The 12 modules (with all 144 chapters)
Module 1. Foundations of OWASP in Public Sector Delivery
Map OWASP Top 10 to project milestones common in municipal and regulated environments. Understand where security decisions impact delivery velocity.
12 chapters in this module
- Defining OWASP scope in non-technical project plans
- Linking project phases to OWASP risk categories
- Security milestones in public-facing digital services
- Regulator expectations for municipal IT delivery
- Common compliance gaps in city-led projects
- Documenting decisions for audit trails
- Integrating OWASP into project charters
- Stakeholder alignment on security thresholds
- Risk register integration with OWASP findings
- When to escalate OWASP concerns
- Balancing speed and security in agile builds
- Case: Calgary Transit digital ticketing review
Module 2. OWASP Integration in Project Initiation
Start right: bake security checks into kickoffs and vendor selection. Avoid rework by anchoring scope to known compliance benchmarks.
12 chapters in this module
- Security criteria in RFI responses
- Vendor pre-qualification using OWASP checklists
- Scope language that prevents downstream conflict
- Including OWASP in project charter sign-off
- Kickoff meeting security agenda
- Documenting third-party risk assumptions
- Baseline definitions for secure delivery
- Project manager’s role in OWASP scoping
- Aligning legal and security early
- Tracking security commitments in contracts
- Municipal procurement nuances
- Case: City of Edmonton portal rebuild
Module 3. Threat Modeling for Non-Technical Leads
Lead threat assessments without coding knowledge. Use structured frameworks to guide technical teams and document decisions.
12 chapters in this module
- Running threat workshops without technical depth
- Using STRIDE to frame discussions
- Documenting design decisions for auditors
- Mapping data flows to OWASP risks
- Creating visual threat maps for leadership
- Security decisions log template
- When to loop in internal security teams
- Preventing scope creep from security asks
- Timeboxing threat analysis phases
- Outputs expected from external vendors
- Common misalignment points
- Case: BC Housing tenant portal review
Module 4. Vendor Security Review Ownership
Take full control of third-party review cycles. Use OWASP to set expectations, track compliance, and close loops without escalation.
12 chapters in this module
- Receiving evidence from vendors
- Assessing SOC 2 reports through OWASP lens
- Using CAIQ questionnaires effectively
- Scoring vendor responses objectively
- Identifying red flags in documentation
- Follow-up question templates
- Managing review timelines
- Escalation paths for gaps
- Legal hold points for non-compliance
- Documenting decisions for later audits
- Building a vendor security history log
- Case: Alberta Health Services SaaS rollout
Module 5. Secure Development Milestones
Track progress using OWASP-aligned checkpoints. Ensure developers deliver compliance-ready outputs at each stage.
12 chapters in this module
- OWASP gates in sprint planning
- Code review expectations for project leads
- Security testing integration points
- Pen testing scheduling and scope
- Tracking findings to resolution
- Reporting progress without technical jargon
- Integrating DevSecOps outputs
- Managing retesting cycles
- Sign-off checklists for non-developers
- Handover documentation standards
- Avoiding last-minute fire drills
- Case: Toronto 311 service upgrade
Module 6. Documentation for Audit Readiness
Produce artefacts that satisfy internal and external reviewers. Focus on clarity, consistency, and source-backed claims.
12 chapters in this module
- Building the audit package proactively
- OWASP narrative for non-technical reviewers
- Version control for compliance docs
- Evidence collection templates
- Cross-referencing controls to findings
- Formatting for regulator clarity
- Internal review submission process
- Preparing for follow-up questions
- Maintaining documentation post-launch
- Archiving for future audits
- Common feedback loops from assessors
- Case: Vancouver Open Data Platform
Module 7. Stakeholder Communication on Security
Explain OWASP implications clearly to executives, legal, and non-technical teams. Keep momentum without oversimplifying.
12 chapters in this module
- Translating risks for leadership
- Framing delays due to security work
- Building trust through consistency
- Regular security status updates
- Handling media-sensitive findings
- Messaging during incident prep
- Aligning legal and communications teams
- When to disclose vulnerabilities
- Maintaining transparency without panic
- Building a reputation for integrity
- Owning the narrative under pressure
- Case: Ottawa Wi-Fi network rollout
Module 8. Regulator-Facing Review Execution
Lead responses to compliance inquiries. Deliver complete, confident packages that prevent follow-ups.
12 chapters in this module
- Understanding municipal regulator expectations
- Receiving and triaging requests
- Assigning response ownership
- Reviewing technical inputs for accuracy
- Compiling evidence packages
- Pre-submission quality checks
- Handling tight deadlines
- Documenting exceptions properly
- Building institutional memory
- Post-review closure steps
- Improving for next cycle
- Case: Alberta Auditor General review
Module 9. Post-Implementation Security Sustainment
Keep systems compliant after launch. Monitor, update, and prepare for renewal cycles.
12 chapters in this module
- Operating model handover to IT
- Defining ongoing testing schedules
- Monitoring for new OWASP risks
- Patch management coordination
- Annual review planning
- Budgeting for security upkeep
- Vendor contract renewals and OWASP
- Tracking changes impacting compliance
- Incident response integration
- Lessons learned documentation
- Updating playbooks for next project
- Case: Calgary Parking Pay App
Module 10. Cross-Functional Escalation Leadership
Become the go-to resolver for peer teams. Use OWASP as a shared standard to align conflicting priorities.
12 chapters in this module
- Receiving escalations from peer projects
- Assessing severity and impact
- Convening the right parties
- Facilitating resolution workshops
- Documenting cross-team decisions
- Owning the final recommendation
- Communicating outcomes broadly
- Building reciprocity loops
- Earning repeat referrals
- Scaling influence beyond your team
- Maintaining neutrality in conflicts
- Case: Inter-municipal data sharing initiative
Module 11. Building Reusable Compliance Artefacts
Create templates, playbooks, and checklists that compound value across projects and teams.
12 chapters in this module
- Identifying repeatable components
- Template design for clarity and reuse
- Naming conventions for discoverability
- Version control for shared assets
- Onboarding new teams to playbooks
- Tracking usage and impact
- Improving based on feedback
- Sharing across departments
- Protecting sensitive templates
- Building a compliance knowledge base
- Integrating with existing PMO tools
- Case: Provincial PMO adoption in BC
Module 12. Owning End-to-End Security Outcomes
Lead from initiation to audit with confidence. Deliver trusted, repeatable results that elevate your role.
12 chapters in this module
- From project start to sign-off
- Creating a personal delivery signature
- Demonstrating leadership beyond timelines
- Measuring security success quantitatively
- Building a track record of trust
- Positioning for complex assignments
- Mentoring junior project managers
- Sharing best practices externally
- Contributing to policy evolution
- Maintaining personal credibility
- Creating lasting institutional value
- Case: Mike Keizer’s multi-project legacy
How this maps to your situation
- Leading a municipal digital service rebuild
- Managing third-party vendor security reviews
- Responding to regulator compliance request
- Resolving cross-team security escalations
Before vs. after
Before
Waiting for security teams to validate designs, reacting to audit findings, rebuilding deliverables after review
After
Shipping OWASP-aligned documentation on time, leading reviews without escalation, owning sign-off decisions
What's included with your purchase
- 12 modules with 12 chapters each (144 chapters)
- Downloadable templates and worked examples for every module
- Hand-built implementation playbook delivered alongside course access
- 30-day money-back guarantee
Delivery and format
- Course and learning environment access provisioned within 24 hours of purchase
- Hand-built implementation playbook delivered alongside course access
Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access.
Time investment: 60-90 minutes per week over 8 weeks to complete all modules and implement core templates.
If nothing changes
Projects will keep facing last-minute rework, stakeholders will lose trust in delivery timelines, and high-visibility security work will go to teams seen as more reliable.
How this compares to the alternatives
Unlike generic OWASP training for developers, this course is tailored for project leaders , focusing on documentation, decision-making, and stakeholder management. No coding required, no theory without application.
Frequently asked
Do I need technical development experience to benefit from this course?
No. This course is designed for project leaders who need to manage security outcomes, not write code. All concepts are taught through project management lenses.
How is the course structured?
12 modules, each containing 12 chapters (144 chapters total).
Will this help me in municipal or public sector compliance reviews?
Yes. The course includes municipal-specific examples, regulator expectations, and documentation standards used in Canadian public sector audits.
$199 one-time. 60-90 minutes per week over 8 weeks to complete all modules and implement core templates..
Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.
30-day money-back guarantee·
144 chapters·
Hand-built playbook included·
Account access within 24 hours