The fact that you are realizing that issues are being found so late in the SDLC is a sign you need to hire security people. But here's the difficult part. There are many different disciplines in Information Security, and you may need to hire more than one person to cover the different disciplines. For example, the following are each different skillsets. There may be some overlap, but you'll be hard-pressed to find someone who is skilled at everything that has the depth necessary to get the job done correctly.
- Software Architecture
- Network Architecture
- Code Review
- Penetration testing
- Vulnerability assessments
- Risk management
- Developer education
There also should be questions about where you want a security program to mature to. If you hire penetration testers that just find vulnerability after vulnerability, you'll end up with developers who keep writing bad code, because their mistakes aren't caught during the development process. Or during the design process. It's really hard for me to tell someone "yeah, I found this serious design flaw. You'll need to rip out a bunch of code to fix it." That's financially expensive. Human-time expensive. And developers don't really get education out of it.
It should be noted that even within each of these disciplines, there's different skills. For example, software architecture can be someone who is embedded in a team, but from the security team, helping design software. Or it can be someone who takes documentation near the end of the design process, reviews it, helps the team understand design flaws. Both approaches have their pros and cons. Or you may find people who are good at risk management when it comes to physical security, but not information security. Or people who are good at vulnerability assessments, but not good at penetration testing.
Take stock of what the company needs now, and start developing a security program around that.