Perhaps test teams could include a security sub-team as well..

So, for example, if a tester is working on whether the file upload feature is done right, another tester could start uploading known malicious files to see how they get handled.