Comment by idontwantthis

Hire a CISO and let them build a team empowered to improve your security. Don't depend on a decentralized approach. The most important aspect in my opinion is locking down permissions so that no one has access to everything and each team only has access to the components they need access to. Then one hack doesn't take down the whole company.