In my organization, our server infrastructure team has historically held all admin access to production servers. We're recently trying to strengthen our security posture, so we have hired several new security engineers. We are investing significant funds in new toolsets for them, and we are also trying to identify where we need to change our policies and security models to enable them to do their jobs effectively.
Some of the security engineers believe that they should have admin access to the production servers, in order to investigate suspicious activity, as reported by their new tools.
It has been proposed by the server infrastructure team that they could grant access to individual servers on an as-needed basis for specific incidents. The security engineers argue that such a high-friction process would potentially slow down investigations, which by their nature often take place in situations where minutes count, and where they don't really know which servers they will need access to until they're elbow-deep in the investigation, and pausing every few minutes to request access to a new server would be unnecessarily cumbersome. The server infrastructure team argues that the security engineers' tools should provide visibility into the broad majority of the data the engineers need, and they are reluctant to grant blanket admin access to the engineers.
Are there recommended best-practices for such situations? I understand the server infrastructure team's desire to maintain principle-of-least-privilege for security's sake. But I also understand that security engineers are somewhat implicitly trusted by the nature of their role. In large organizations, how is security engineers' access to servers typically managed?