They may not have one, or have one that’s so underwater with larger issues that the rest of the org doesn’t know how to route things to them.

Hiring for technical security is hard—you need engineering expertise to find good people, and then you need someone with an infosec background to vet them.

Finding a combination of both is surprisingly rare and you usually find infosec folks who can define but not implement a security program, or an engineer that can implement a security program with no idea how to run or grow it.

I need more peers in this space. If you’re reading this and are a software engineer looking for a transition please do reach out—email is in my profile. There’s a huge demand for security engineers and not nearly enough engineers interested in doing it.