From what I have seen, most corporate it security people are at a service desk level at best. They are tool runners who don't really understand what the tools spit out, they just go bug other teams about it.