I have to say your head security guy was way ahead of the curve.

Anywhere I’ve worked it was firewall everything and use VPNs, and most places still do this. SFTP was in the too hard basket. And of course that led to people emailing files around as standard practice (and the only option) and inevitably some got emailed to the wrong recipients.