FinTech doesn't always mean global mega bank. There's lots of small scale start-ups that fit into the financial services category that wouldn't/couldn't afford full time InfoSec roles.

Outsourced CISO/InfoSec is a valid and reasonable thing for some companies.

I feel like a small scale startup needs internal infosec and audit teams even more. Unlike the incumbents, who are "too big to fail" and therefore are able to get away with blatant insecurity, a startup's in a much more vulnerable position, and any security breach is significantly riskier in terms of corporate longevity.

If I was running a financial services startup, those groups would be near the front of my list in terms of internal hiring.

Why would they? There are still to this day no downsides to a customer data leak here and there.

There are huge repercussions. We are governed by PDPA (our GDPR equivalent) law where penalties are extreme. Thailand takes Data Privacy as seriously as EU.

But again, since it's not always easy to find the right people I end up having to fill in for everything we don't have a team member to execute on.

Did anyone ever went to jail over a data breach? Though so.