I am the team lead on the IT Security team where I work. Recently we were interviewing for an security engine role. One of the traditional security / SOC engineer roles in all the places I worked is leading security code scanning and vulnerability remediation.
When I asked candidate what experience they have with static and or dynamic code scanning tools (SAST / DAST), they responded they used tools such as BurpSuite and SonarQube among others but the security code scanning process is more owned by development , not the cybersecurity. These candidates come from well known companies with mature histories so I expected much more more security ownership in the code scanning / vulnerability management process.
As this candidate has significant experience in working with our suite of security tools such as BurpSuite, MetaSpoit etc, I dont want to pass over them simply due to them used to a different process. However, the willingness own the code scanning vulnerability management processes is a critical requirement of the role.
Is ownership of secure requirements during development by teams outside of cybersecurity a common occurrence in big, mature companies?
How should I evaluate candidates with significant experience in using the technical tools of our team but may not have experience owning processes or are used to working using a significantly different process owned by another team?