Almost every security team I've had to work with was incompetent, box tickers (for compliance) or some combination of the two. I was offered two security positions and turned them down because I knew they would be shit. They rarely have any developers (one wanted to hire me internally because they desperately needed a developer and wouldn't stop harassing me to apply because I posted something about attending DEFCON in a Slack channel).