Ask HN: At which point should a startup build a dedicated security team?

Hi, I'm the technical co-founder at a small startup serving among other types of clients large consumer companies and banks. In order to grow our services/revenue within these companies we are going through an IT security homologation process with some of them. The list of policies, practices and procedures they evaluate is pretty extensive, ranging from the SDLC, data management, disaster recovery, up to the physical office space security and HR processes. So my question is, what's an effective strategy for complying with customers security requirements? Have you gone through a similar process while growing your startup? At which point should a startup consider hiring specialized security folks / building a dedicated security team? Thanks in advance!