Yea 100%... our company has gone through CSO's, at least one of them actually setup owasp and sonarqube himself.

The latest though... just good at creating documents, because he came from government background and all they care about is checking boxes. An absolute wizard at absolving himself of responsibility, very jealous.