I have security experience mainly in big companies, but this is the approach that I will take: start to prioritize the needs. I suggest to use a threat model m

I have security experience mainly in big companies, but this is the approach that I will take: start to prioritize the needs. I suggest to use a threat model methodology (STRIDE or PASTA are fine) to understand what are the main assets and the risks and start protecting them. When you have identified the key assets and the risks related to them, you can start thinking about security controls (not only technical, also from an organization perspective) to reduce them or accept them in agreement with the management and stakeholders. Starting from scratch can be difficult, because you need to setup processes and policy, maybe you can ask help for a consultant company in the first steps.