There's parts of security that don't require code, like writing general policy, dealing with regulators, facilitating threat modeling, running tabletops, etc. I

There's parts of security that don't require code, like writing general policy, dealing with regulators, facilitating threat modeling, running tabletops, etc. I wouldn't hire an entire team of software engineers for security just like I wouldn't hire a team of folks who can't code.