i tell you what, it's weird going from an explicitly security-centric dev job to one outside that sector
things i took for granted like "think of how someone could move laterally across what you're deploying" are having to be pushed as "security champion" activities
going from a set of people that would freak if they saw the aws policy "resource: *" to ones that go "eh it's probably ok"
very odd