This question at security.stackexchange describes the problem with combining security audits with agile project management. There are some answers that you might or might not find helpful.
https://security.stackexchange.com/questions/69067/how-can-security-audits-be-integrated-into-an-agile-project