Security is not a magic paint that someone can just add on top of the finished product, it needs to be a part of it from the beginning, starting with analysis.

Security is not a magic paint that someone can just add on top of the finished product, it needs to be a part of it from the beginning, starting with analysis. Which means it is the developers' job, but not only theirs - the specification should also be aware of security.