In every billion dollar company I've worked at, the infosec team has numbered less than 10 people.

And are entirely focused on compliance and checkboxes rather than whether the systems are actually secure.