Is he the security guy in charge of the physical building or some other physical security controls or is he the security guy in charge of IT and computer softwa

Is he the security guy in charge of the physical building or some other physical security controls or is he the security guy in charge of IT and computer software systems? For one of those options I would say it should be of no concern at all. For the other it would be a red flag to me especially if you run a mix of different operating systems because in order to appropriately evaluate security one must have some passing familiarity with the common tools of those operating systems. Unfortunately my experience in the industry tells me that this security guy probably actually has a job title of security and compliance officer or some such thing. Usually what that means is 99% of what they do is compliance with predefined security requirements and they have no actual ability to understand security and the implications of choices in security. They simply have a compliance check sheet that they run through and you are considered secure and in compliance when you can properly check all the boxes or properly note all of the exceptions. There is very little real IT security that goes on in most places.