I considered it for a bit, they were hiring their first security engineer, so it's understandable that they weren't very sure what they were hiring for.

In the end there were a lot of other issues that made me not take it, but not knowing what is necessary seems pretty typical wrt security. However, in those situations you want to have wide latitude to affect change because the thing they hire you to look at is probably not really where their problems are.