For one of those options I would say it should be of no concern at all. For the other it would be a red flag to me especially if you run a mix of different operating systems because in order to appropriately evaluate security one must have some passing familiarity with the common tools of those operating systems.
Unfortunately my experience in the industry tells me that this security guy probably actually has a job title of security and compliance officer or some such thing. Usually what that means is 99% of what they do is compliance with predefined security requirements and they have no actual ability to understand security and the implications of choices in security. They simply have a compliance check sheet that they run through and you are considered secure and in compliance when you can properly check all the boxes or properly note all of the exceptions. There is very little real IT security that goes on in most places.
Does 100% of infosec people know about linux cli utilities? No certainly not.
Flipside, are you his manager? HR? or something that even makes you care about his competence? Do you want him to get his linux+ certification or something?
Why care if he knows anything?
Does he know what a text editor is?