Friday, February 10, 2017, 08:00 am PT (11:00 am ET)
Within the app, first tap on the Settings tab, then on Account. You should then see a Two-Step Verification option, through which you can choose to begin the setup process.
The app will prompt you to enter and then re-enter a six-digit passcode. You can also choose to enter an email address as backup, though WhatsApp notes that it will only send a link to disable two-step verification.
It's important to use a legitimate, easily-accessed email address, because failing to do so could potentially lock you out of your account.
Once two-step verification is on, a phone number can't be reverified in WhatsApp within seven days of last using the app without the appropriate passcode. A passcode isn't required past the seven-day mark, but if you go that route, all pending messages will be deleted.
If a number is reverfied without a passcode after 30 days, WhatsApp will simply delete the associated account outright, and create a new one.