The application is informed of the BLE events( which are generated from controller) through the use of Callback function. The callback function is used for handling the BLE stack events. Some of the events are CY_BLE_EVT_STACK_ON, CY_BLE_EVT_GAPP_ADVERTISEMENT_START_STOP, CY_BLE_EVT_GAP_DEVICE_CONNECTED etc. please refer to the list of BLE Stack events in "cy_ble_stack.h" file. The application Host callback function processes the pending events by calling Cy_BLE_ProcessEvents().
Yes, we can call Cy_BLE_SetSecurityKeys() after devices are connected in CY_BLE_EVT_GAP_DEVICE_CONNECTED event. Please refer to the code example "CE212742_BLE_4.2_DataLength_Security_Privacy" in PSoC Creator for more information.