Infrastructure-as-code is enabling application teams to build architectures with unparalleled scale, complexity, and velocity. Security-as-code is the only viable approach to securing these architectures. This talk will walk through a journey in building an open source security-as-code framework and will present case studies that show reduced risk, improved productivity, and reduced costs.