I worked for a "systemically important financial institution" (known as SIFIs in the industry). I also worked on critical functionality, like payment processing, wire transfers, etc. Seeing how that sausage was made was eye-opening.<p>One time, there were reddit threads circulating where customers were complaining about logging into their bank accounts then seeing the information of another user. I brought up during stand up, and my team lead freaked out, took me around the corner in the hall way, and screamed at me for 10 mins straight about how I am compromising the security practices of the company (OK, guy). Weirdly, there was not mainstream media attention or any discussion internally. My guess is the policy is to suppress aggressively when flaws become public, especially with security.<p>Given the nature of the financial services business, you would think they would have the highest paid and most competent tech workers, but fuck no. For the most part, we would hook up FOSS components to talk to our legacy back end monoliths (usually mainframe dinosaur machines that should have been extinct a long time ago) and then render the desired output to a web or mobile interface. So the good news is that your security is as good as the open source engineer's implementation (which most of the time would be Java / Spring / Oracle / Pivotal, or C#/ .net / MS) bc that is the tooling we would build on. More good news is that, due to risk aversion, things do not change often at banks bc of fear of mistakes (downside being that there is les innovation).<p>In all honesty, I would rather trust amazon, google, or even netflix with my finances over big banks. Except facebook, never trust facebook.