A lot of the issues discovered reside within the application code and are classical application vulnerabilities such as mentioned in OWASP documentation. Only by fixing the bug within code will the vulnerabilities be remediated. However, developers assigned to stories very frequently (double digits in a single day) IM me or a team member on my team requesting solution validation , questions on implementation etc such that it disrupts other work we have - incident response, vulnerability scanning, compliance reviews etc.
I speak with more than a decade of experience in software development. If you are attempting to resolve every known vulnerability in a single release, trying to validate each fix makes sense, but it is extremely difficult to write software that doesn't have bugs in it. Which means is the development team will always be fixing vulnerabilities, so your company must do something else, otherwise your team will only be validating bug fixes.
Your company should identify how these vulnerabilities will be fixed. Your security team should be evaluating a potential release build, ahead of a potential release date, that allows the build to be released on time and with the appropriate number of security vulnerabilities fixed for that build. The developers should be allowed to identify what security vulnerabilities have or have not been fixed in that build.
I don't want to slow down development of fixes, nor appear aloof and unwilling to help. To a certain I understand the developers actions as our team are the experts in security.
Developers don't need to be experts in security to understand how to fix a vulnerability. If a vulnerability has been identified, and the improper and proper behavior both have been identified, then a developer should be able to validate a software fix results in the proper behavior. This allows your team to validate fixes, ahead of a potential release date, with enough time for the development team to identify which bugs will be left for the next release cycle.
Perhaps a wiki or knowledge base solution is way to go so that questions can be compiled and answered asynchronously? Developers are of different experience levels with some needing more help than others.
Sadly, there is no single answer to this question, this is something your company can decide.
How can I politely say the 1 off requests via IM is starting to be unworkable?
You have the ability to implement change yourself, you should determine what system will be used, to verify if a potential fix does or does not address a vulnerability. As the team lead, you should talk to the other team leads, and determine the best way to move forward. You should allow those team leads, to handle the other end of the rope, it sounds like you have enough to deal with.