What does internal software development QA look like in your organization and is it successful?  Embedded, federated, centralized, etc..?

We have our quality engineers report to respective engineering leaders. Having this embedded approach provides cross training and opportunities to building t-shaped skills. We have found good success with analysts moving into quality engineer role and vice versa. This also helps in having a cohesive team that works together as one team delivering products.

We also have formed a centralized quality center of excellence (COE) to enable enterprise quality standards, tools, and processes. All quality engineers across the organization get to collaborate, exchange learnings, and share best practice. This also helps avoid isolating quality engineers from their peers in similar roles.

We use an embedded model. We like this because each team has different QA needs, and we found it hard with our previous centralized model for the centralized manager to maintain so many different contexts and actually be helpful. Now that quality engineers report to their respective engineering manager, there's more accountability to focus on the needs of the team and upskill fellow developers on quality matters. On some teams, a quality engineer is no longer needed due to the team ownership of quality.

Certainly, there are some drawbacks with the embedded model. The main one we've seen is lack of coordination on tools and patterns. This is counteracted by having a more senior QE stay plugged in to what other teams are doing and help standardize where it makes sense.

It depends (product org vs project org) ... if you will deliver a software as a part of a system , the best way is to build specialized  QA teams (for example team 1 : qualification of sensors, team 2 : qualification of the embedded software, team 3 : qualification of the whole system), those teams reported their observations to the quality processus and always keep an external eye on the project  ...if the software is your main product  so you must follow DevOps/DevSecops guidelines: build a CI/CD pipeline with integration of OWASP frameworks to test security and consider time to do some Black Box tests and Non regression tests, in that case QA team will be part of the big project team.