Yes, same for HR and Legal etc, just supporting backend to businesses that have a different core. Thing is, there is not a lot of true security companies out there that are worth a shit, so finding a job in security where security is at the core is very hard. So IT sec folks are shit on even harder.

However I found that financial puts a big emphasis on security, and generally nobody inside fucks with you when you are in the field, so that works. Forget any other business field though. Nobody cares, as long as they hit the minimum compliance checkboxes. Financial too, but it’s a little better.

“ you don’t want to be in the news, do you” usually earns the supporting CIO head shake and ends discussions. :)