It's also chronically understaffed.
That might be true. But the answer isn’t hiring someone with no real world experience. I would hire an entry level developer before I would hire an entry level security person.