One standard I have been tasked to bring my databases up to asks me to separate security functionality and non-security functionality. Based on supplemental reading, this seems to be talking about hardware, software, and firmware dealing with encryption, authentication, authorizations and auditing.
Pursuant to this goal, and just as a general question to you experienced people, is it acceptable for a DBA to also be acting as a Security Administrator? Separation of duties would seem to say no, as DBA work, while administrative and highly privileged in nature, is mostly not security-related in nature. But if it would be prohibitive to hire someone as a DBA and another as a security administrator, what would be the largest areas of concern, if any, if one person performed both of these sets of duties?
ETA: I can't give many details to the best of my understanding of my restrictions, but security concerns are high, budget is tight, and the databases range from small, non-application databases with few users to users in the thousands with an expansive number of tables, each with an expansive number of rows of information. DBAs are utilizing the DBA role, so the most expansive set of privileges. And it looks like I accidentally removed the oracle tag, so I'll put that back on and mention that this is an Oracle database.
For the sake of discussion, let's focus on the largest subset of databases. These have personal and financial information in them. I think I can say that we are shooting for a standard that heavily leans on the NIST database standard, but isn't NIST for whatever reason. Not sure if that helps at all.