Sounds like the company doesn't have a clue about cyber security then. Tens of thousands is a piddling infosec budget for anything but a tiny company. Also, Insider threats, malicious or otherwise, should always be on an infosec professional's radar.

Companies not giving a shit about cyber security is probably not a secret but it is still pretty common, I think, so nobody should be surprised when there are major breaches.

Infosec is usually seen as an expense that cuts into profits. Assuming top level management and the board give a shit about security that's great but often the risk isn't fully appreciated at the top or is managed poorly.

Adequate infosec requires a company to have very mature processes across the board in IT (and likely beyond). C-level "buy in" isn't enough. If the C level management and board doesn't actively demand it, infosec will lose out to myriad other priorities every time.

The big tell is the org structure. If the CISO reports to the CEO, great. If they're reporting to the CIO, CFO, etc., that can cause conflicts of interest. It can still work. If there is no CISO or they are the same person as the CIO, or if infosec reports several levels down in the org--beware!