How to Improve Security Awareness of Software Engineers (blog.dashlane.com)

Perhaps test teams could include a security sub-team as well..

So, for example, if a tester is working on whether the file upload feature is done right, another tester could start uploading known malicious files to see how they get handled.