> But doesn’t that mean you need at least one full time security auditor just to keep pace

Crazy idea - maybe you shouldn't be writing financial software if you're not going to audit the code that you're using