Ask HN: DevOps folks, how much time do you spend on security vs. compliance?

I keep hearing from some DevOps leaders that compliance is a pain in the behind and they spend an inordinate amount of time on compliance certifications. Would like to hear more viewpoints.