Answer depends on the outcome you're looking for.
214 karma · joined February 6, 2019
I've learned much of compliance/security is cargo culting and/or streetlight effect, if not radicalized.
You can debate the standards, just like you can debate with your retired uncle who watches way too much fox news.
The better solution is to find good enough solutions that let infosec teams check their boxes and move on to more important work.
A software engineer builds to a well defined spec, that likely came from a waterfall process.
A product software engineer gets a story, that largely draws no conclusions as to what needs to be built. It's up to the engineer to hypothesize, experiment, and iterate.
Don't focus on the input variables (ie we have n engineers). Focus on the output variables. What are the SLA/Os for each service? If they're being met, then it's unlikely anything should change. Missed SLAs should trigger changes (see scaled agile framework).
Tech debt is likely high if there's little to no value placed on documentation, in favor of "bias to action".
https://rocketreach.co/privacy
Information isn't current and is likely from a LinkedIn data dump.
DevOps, SRE, doesn't matter. A name doesn't guarantee you're doing it right.
Already doing regular retros? If yes, then are you capturing what's causing pain and is the team collaborating on how to fix?