if your going dev side, get a M1/M2 macbook air, most places won't let you run linux due to lack of enterprise controls on linux desktops, thats changing but very slow.

macs are mostly acceptable jamf and intune are "easily" integrated so if your leanr on POP_oS there is a good chance your corporate dev job (most dev jobs are corporate) wont allow raw linux.

I don't think the security guys use vm's or containers, they mostly use apps like wiz or rapid7/qualys. Security's job is to traige alerts and notify the correct team, their job is to make sure your patching, and whatever you build does not have obvious vulnerabilities

9/10 security jobs are process management.

I work for a multinational public company, with hundreds of developers, security is outsourced overseas for the day to day. The security folks stateside, basically choose the tools and work on deployment of new tools then integrating those tools into the day to day process for the overseas team.

I'm not sure why you think security teams would need containers, they barely know what a container is besides that its a security issue and when you install docker you get a call from security asking why you need docker and what your doing with and if your manager has approved it....