I've done InfoSec for a bunch of startups, none seem to grasp the importance of security by design and how it can play an integral role in the business. It's exhausting to have to battle a neon-haired developer that wants to just write code (rightfully so,) not following a process or standards often engaging in arguments just to be right. Imagine one person going asking an entire engineering org to create security priorities until business gets a hold of those and comes back to yell at you for delaying sprints, yep, that's InfoSec for you. Also, any business that says "We take security seriously" isn't. That's a boilerplate they plucked out of the legalese to CYA.