&gt;A root cause seems to be that everyone with the aptitude for security crowds toward jobs that don&#x27;t actually involve implementing good security.<p>To expand on this, I&#x27;ve also noticed that &quot;security&quot; in enterprise-size companies tends to be a dumping ground for helpdesk+ staff -- people that can read a CVE or parrot &quot;best practice&quot;, but not really grok the subject or think critically about it (e.g. jumping from one password to another every 3 months isn&#x27;t &quot;more secure&quot;).  It&#x27;s been my experience that people in security teams can&#x27;t implement the fixes to the things they complain about because if you&#x27;re a security-minded dev, your career path will be in dev.<p>&gt;It&#x27;s not as fun to be a developer that is really into security but only have that be part of your job.<p>I think it would be ideal to have security as a parallel track to regular dev staff -- with their placement in the ecosystem being between dev and QA.  Much like how &quot;devops&quot; was used as a hiring filter to have sysadmins that can at least read code, I think we should have a &quot;devsec&quot; group that bridges security-QA and dev.