Setting up an inbound proxy VM that NATs all your other machines is not "difficult". There are plenty of tutorials online for doing this with nginx or Apache,

Setting up an inbound proxy VM that NATs all your other machines is not "difficult". There are plenty of tutorials online for doing this with nginx or Apache, and even a junior dev ops person should be able to do this in a few hours' work. I highly doubt this requires hiring another engineer.