I have a security team. Here's how we do it (with the added requirement of SOX compliance):

Networking team - The network architect designs and lead implements all network infrastructure (campus, DC, and edge switching/routing, wireless, firewalls, remote access, etc). The network engineers subordinate to the architect manage the devices. Anything the network team changes anywhere requires informing security of the changes for review and possible approvals.

Security team - The security architects feed network security requirements that drive a lot of the configuration of security policies. The architects have read-only access to everything so they can review risk across devices. They cannot make changes though. A subordinate security infrastructure engineer will tweak changes as necessary and networking is an informed party during the changes. Security engineers have full admin access to security devices and nothing else. Large impacting changes require discussions between both teams and go through change control. Firewall requests get submitted through a ticketing portal with specific fields that have to be filled in. The security architect reviews the form and approves it for implementation by a security engineer, networking always being an informed party. The form is required by SOX to track changes to access control devices. Some companies outsource this function to comply with SOX if they lack an internal security team. They get dinged on a segregation of duties (SOD) failure if they don't do that. The only devices the security engineers can directly make changes to are security devices (firewalls, IDS/IPS, remote access, ACS/ISE, etc). They can't directly change security on anything except those devices.

There's also SOC (security operations center) which are low level administrators who review events and logs. We've outsourced this function to an MSS (managed security service) which has a direct linkage to our SIEM and manages that for us. It is cheaper to do that than employ the 2-4 bodies necessary to run an effective SOC.