People just don't see them because this happens well above the IC pay grade and takes some time to percolate down and no one wants to publicly announce you shitcanned 5-10 people in middle management and security leadership because you enter thorny employee litigation territory.
That said, I agree with the author about mismatched expectations, though I can safely say that $500k year is VERY HIGH for a CISO. I know CISOs for publicly listed F500s who earn around 200-300k at most after 15-20 YoE.
The bigger issue is CISOs, VP Security, and Security ICs are not enabled institutionally.
If I'm honest, most security engineers suck. 90% are crappy IT Admins or Compliance Monkeys who did CISSP and maybe worked for PWC or an MDR for 1-2 years and don't know the difference between NFTables and NTFS. Most CISOs and VP Sec are former security engineers in turn.
Security Engineering NEEDS Security Minded Engineers. Now that development teams own Platform Management and Deployment, they should also be enabled to own Security, and a Security Team of 10x Engineers with a Security background should help with implementation and guidance internally. At least this is the model I've seen in tech forward public companies (some of whom HNers wouldn't even realize are tech first).
I also agree with Scarlett that data protection laws are critical and need to be enforced. That said, it's not enough (wouldn't protect against a vulnerability disclosure or misconfigured ACLs), and several Security ICs I trust recognize that as well. That said, the tone of the author and a couple well intentioned security minded engineers can impact this larger effort. You trap more flies with honey as they say.
A security minded engineer cannot present this kind of an article to their non-technical leadership, as it opens multiple questions about liability, ownership, and potential incompetence.
> Absolutely no amount of gentle pleas disguised as executive orders from the White House urging people to use memory-safe languages will solve the problem. CISA, despite all the phenomenal work they do, can't charge people who mishandle data with negligence; critical infrastructure involved or not
Amen to that! There's a reason why pushing for cybersecurity insurance might be a good push - hurting the bottom line is a good forcing function for change.
----------
Also, Engineers need to stop being shitty to QA and Platform Engineers.
Treat QA, IT, and DevOps as a first class citizen.
I don't give a rat's ass that you like using Mosh or xyz project on GitHub (not trying to pick on Mosh).
I don't care that you feel restricted by having to use MacOS laptops and SSHing into a CoLo protected behind ZPA when you'd rather use ArchLinux on your work laptop.
Every bug, misconfiguration, or non-standard platform deployment needs to be treated as a potential security liability.
Sure it might slow down the deployment of your "yet another wrapper around an LLM SaaS" but there absolutely needs to validation.