The situation: An established SaaS startup with <100 employees, a large development team and several self taught networks engineers. Our business involves handling both PII and payment data.
As we've grown and given the increasing focus on infosec we've been receiving more customer demands for ISO and NIST compliance, SOC 2 reports and the looming threat of PCI.
At this point our infrastructure is reasonably secure but policies and procedures are very green and most put in place adhoc to satisfy a customer demand.
My question is: How should a company approach developing a more mature security compliance program and what costs are reasonable for a business this size to spend?
Most consultants recommend starting with a security risk assessment, then gap analysis then consultation as needed to develop policy until compliant.
Lawyers recommend working directly with a firm for everything. At this size should a company begin to think about hiring a dedicated security compliance specialist at upwards of $120k per year? Or is it just a matter of telling the network engineers to drop their projects and start boning up on ISO and NIST for the next several months?
TLDR: What is a sensible approach to start building a mature security compliance program for a small to mid sized company? Are consultants a must or does it just require elbow grease? Where does money need to be spent, where is it a good idea to spend and what is a waste?