Agreed - none of the QAs I have ever worked with have done security testing (unless called out in the test plan). One of the companies I have worked for does an

Agreed - none of the QAs I have ever worked with have done security testing (unless called out in the test plan). One of the companies I have worked for does annual penetration tests which seems reasonable.