> but it could be that they had a lot of folks who were analysts but weren't contributing much to remediating issues. Neither feature testers (does it behave a

> but it could be that they had a lot of folks who were analysts but weren't contributing much to remediating issues. Neither feature testers (does it behave as expected) or security testers (is it secure as it does it) are expected to write fixes. Writing fixes needs to be planned in the sprint and is better worked on by an expert on that system. > they're hiring a small number of security engineers (maybe even one) to not only actively look for security issues, but to also actively work to remediate them and improve code security posture as well. If this is true, it could seriously affect their ability to ensure the system remains secure. Sometimes a security issue will take a long time to hunt down, and perhaps require a large rewrite to deal with it. Whilst this person is dealing with this, they are no longer looking for new issues. I'm just not sold this is anything but a cost cutting exercise, and could (theoretically) lead to bad practices in the future.