When the organization itself takes security seriously, it can be so much better. I'm at a telecom, where we have multiple security teams. Ours is all about secu

When the organization itself takes security seriously, it can be so much better. I'm at a telecom, where we have multiple security teams. Ours is all about security testing, and we're regularly meeting with dev teams to discuss findings, exploring them together if necessary. I'm not always sure about the project managers, but the developers definitely seem to appreciate the insights and guidance. I should note, understanding the issues helps, as you can also tell them what findings are irrelevant in their specific context. For web app security for instance, many issues are browser-related, and may not matter for inter-system API calls.