The longer I work in InfoSec, the more strongly convinced I am that security people need to be deeply embedded in the day-to-day workings of their organization--not to interject friction at every point, but to understand how the business works and what the priorities are.

Many InfoSec people mistakenly believe their job is to pitch security "advice" at the business from outside, which is just actively harmful in many ways.

There is no "right" way to do things. There are safer ways to do the things you're doing.

And most importantly, what you choose to do from a security standpoint should align with focus areas and competency of your organization. Where can you get a lot of "bang for the buck," where can you utilize existing skills and resources the organization has?