> never met a security engineer that was eager to do that

Of course not. We do the fun parts, and write tickets to make the dev team do the boring parts that we will later complain are not implemented to the quality standard we would have reached, had we done the work. That's the deal.

Late to reply, but yeah no one is eager to do it. Unfortunately being good at security means being really good at work that is boring, tedious, and not glamorous, which also measures poorly into OKRs and other facets of shipping culture. Unless the team has really strong leadership that can get the security engineer ladders divested from the SWE/SRE ladders.

I literally just finished up writing up something that does supply chain provenance checking across 9 languages and still have a lot of edge cases to handle. It's not fun, but it's honest work.