So! Someone has recruited you to set up a full InfoSec department! It is a totally green field site.
They have said you are in charge.
The CEO is security aware and wants to do the right thing.
You have the budgetary authority to spend on people (but not tech)
You can build a full security division if you want.
What does it look like in your world - and with those massive doobies you would need to smoke to make this a reality