How much security testing should sit with SDETs vs a security team?

We have a small AppSec team (2 people) and 40+ engineers. AppSec can't keep up with review. SDETs are being asked to "shift left on security". Where's the reasonable line? Am I supposed to become a pentester on top of my day job? What security checks *should* SDETs own (SAST triage? auth flow tests? OWASP top 10 basics?), and what should stay firmly with AppSec? Looking for a division of responsibility that isn't just "everything is your problem".