IMHO it is often the case that security can only be achieved if the design is sound. Overly complex designs are very hard to make secure.

That’s definitely the case when thinking about security in a strictly limited scope. In contrast, my team is holistic — any issue that could affect ICA (integrity, confidentiality, availability) is in our purview.

My team engages in the earliest phases of design. Holistic security is our priority, but not a limiter for our engagements.