I'm honestly curious. I've never seen startups that aren't security startups hiring a security team. Is this a real team or just their developers doing an extra job?
I don't fault them for it if they don't. "The Bitly security team learned of the potential compromise..." sounds much better than "our programmer, Joe, got an email..."
Preferably even the smallest company would have at least a designated "security guy", even if they don't spend most of their time directly on security issues. If there are two, there's your "security team".
Reality, of course, is that most companies don't give much thought to security at all until it bites them in the ass, and security competency is rare enough that even a designated "security guy" could be worse than useless.
I'm honestly curious. I've never seen startups that aren't security startups hiring a security team. Is this a real team or just their developers doing an extra job?