In my experience infosec is more preventative; writing secure code reused by a larger org, reviewing designs from non security teams, maintaining automated monitoring and yes when it happens responding to incidents. Rarely just fixing code issues!

Doesn't sound so bad as I write it and remember it... :)