The following are based on my experience as part of the Security Organization:
Unstable environment
Success is highly dependent on the team you end up in
The vast majority of employees are sub-par in knowledge (however there is some very strong talent to be found as well)
Very poor company values (in practice)
Very poor middle management
Lack of planning and no consistent strategical/tactical approach
Security maturity level could be objectively characterized as initial on the capability maturity model scheme
Investment in security is lead by people who don't understand the security industry.
