You need a "mature" security organization that can stick it's tentacles into everything and still be effective or embed security people directly on teams to gate changes like a CI tool does. A security team that operates at a distance is totally ineffective.

I've worked a bunch of places that have passed various audits and certifications, you know, PCI, SOC, and unfortunately the audits of infrastructure isn't as deep as the average Joe would expect. They place heavier weight on processes over technical safeguards. It's like what they say about the CISSP exam, a mile wide and an inch deep.