I am not a security expert, my experience is limited to admin on a small unix server, so I only know the basics. But I am going to answer your question because the solutions to your problem involve too many (organizational/political) pitfalls for a professional to venture into, as you have already seen.
The crux of your current problem is that someone installed unwanted software on your systems. The solution to that problem does not require a "lock-down", and a lockdown will be overkill - you will lose credibility, and the insider will be tipped off. You lock things down when you are under attack. A simplistic example of an attack is a ddos. So as a first step, sit back and see things in perspective - what has happened here is not too different from someone installing a personal mail client for legit purposes on company hardware.
In general, the greater the "security", the greater the hassles for day-to-day work. For a startup, overdoing the security bit will demotivate people and ruin the culture. There are two parties at fault in your case - 1) the person who installed the miner, and 2) the person who set up the systems in such a way that anyone could install software. The second more than the first.
In a startup, people have a lot more leeway than in large companies. Part of that leeway is allowing people to install the programs they need without having to go through a (long and often frustrating) chain of command. At 10 people, this arrangement is already starting to break.
As you mention, the security culture in the organization is lackadaisical. Make sure management understands this, use this case as an example. Once they do, get one of them (management/founder/etc.) to institute a policy about the company needing proper security practices, and send out a memo to that effect, so the whole thing looks routine.
Start reading standard security practices and follow most of them. For a good reference, get the book "Absolute FreeBSD - the complete guide to freebsd" and completely read the chapter titled "Securing your system". It covers the typical threats, as well as standard practices. But really, read up standard security practices - there are lots of good resources online, find them, study them carefully, and follow them. Or hire someone who can/already has. Lastly, understand that security is always a tradeoff.
Some simple examples of these standard practices are -
- User account security - only very few users have sudo rights on production servers, or company-wide resources. People can admin their own local machines, but only very very few can admin devices across the whole network.
- Groups - create appropriate groups with the right set of permissions, and assign user accounts to these groups. So only certain groups have access to specific resources. This will allow you to avoid giving root access to too many people. You need to think how this applies to your particular setup.
- Network security - disallow password based remote logins, stick to ssh only. Very very few should be able to ssh into the prod server. Have good firewalls, the usual.
- Make sure all local login passwords are strong and changed frequently.
Read the discussion on this security.se question and the ones linked therein.
TL;DR - this is not a disaster, so chill, sit back and think rationally. There's no need for a "cleanup" or a "lockdown". Use this incident as a case-study to convince management to adopt a policy about following standard security practices. Learn about standard security practices and follow them. Understand that security is a tradeoff, you have to make the choices appropriate to your startup.