Yeah. SREs that often fail to patch systems because they're in GoLang building their pipe dream ignoring the basics of good hygiene. Or the App Dev that write enough Ruby blocks to create 10yrs worth of technical debt that they can't pay off if their lives depended on it. Meanwhile, their laptop remains unsecured and unencrypted while their I.P. is up for grabs.
Don't hire a CSO.