>
So why do the the people that are too smart to take on the role of application security champion for the team get promoted, while those security champions are passed over?To put it bluntly, it's likely because the company doesn't value solving security as much as you may think they should. Solving problems is the same as solving valuable problems. If your goal is to be promotable, the problems you should solve should be as close as possible to the items your company values the most. Unfortunately, things like quality and security are not often valued until after things go wrong.
>The defined expectations for that next level are demonstratably higher.
Maybe I'm misreading this, but it sure seems like you're saying the performance for the higher pay is above and beyond what you're currently doing. Now whether those expectations are above what you're willing to do for the pay is a personal decision.
>That's only true from the employee's perspective if the employer is rewarding that.
This is probably where we fundamentally disagree. I think employees also benefit from being engaged. I've worked with people on assembly lines who were engaged with work that most would find monotonous. Instead of finding the work some tedium to be put up with, they actually found ways of getting personal fulfillment out of it. Same goes for low-status jobs elsewhere I've worked. I think your sentiment here is really what underlies unhappiness with work and you'd eventually find the same regardless of how handsomely you'd get paid.
Everything you've outlined at this point seems to indicate you work at a company that has a culture that is misaligned with what you're after. But you also aren't willing to take a risk of changing that. I doubt there are any silver bullets here that will make some magic happen without professional or personal risk.