A development team at a financial services firm follows an agile methodology and releases new features every two weeks. The information security manager discovers that security requirements are only reviewed during a penetration test conducted just before production deployment, frequently causing last-minute delays and costly rework. Which action would MOST effectively address the root cause of this problem?