At a smaller company learn how to play darts. At a larger company learn how to play golf. Kind of true but not the law. At a smaller company you have a lot more juice and autonomy towards getting policies, tools, and the overall environment aligned with a tight security framework. You can also buy/implement solutions without 8 months of red tape. On the negative side you don’t have as large pool of experts to confer with day-to-day so forums such as these are nice. You also have a smaller budget but there are lots of effective cost friendly solutions out there. At a smaller company you get involved with everything from the latest feature that Engineering is working on to issues with the badge readers. At a larger company you MAY hear about those things after they are addressed or if they turn into significant issue. Smaller company you need to know a lot about everything and it’s not as political. Larger company you can tap into your experts on a very specific subject so you can mature a solution this week instead of next quarter. If the opportunities are there it would be best, from a personal growth standpoint, to try both and decide which fits your style best.