The friction from various IT departments are often beneficial. I’m probably speaking from a point of bias as I’m one of those departments, but we often have to sanity check the implementation of things and review the security implications.

I’ve encountered quite a few devs whose only focus is on achieving the specified goal without considering the full security scope. I don’t blame them, that’s what they are there for. Stepping in for ensuring the customer security and regulation requirements is what I’m here for.