The next iteration of that terrible idea is to have a security contractor do that role and report to someone else who decides whether to read the report or not.

DevSec is next, right?