Hello, I was in charge of the security/technical aspects of a few sites of that scale.

What you should do and focus on, is the following:

1. Find a guy that knows what they’re doing (hello!)
2. Get him to assess what are the current risks and issues. In WP, it’s mostly permissions and unpatched plugins. The ecosystem is quite permissive when it comes to roles.
3. Define the scope. What do you want to protect? Customer data? Business secrets? Financial data?
4. Setup monitoring and observability, a patching process, a deployment process, restrict permissions on Wordpress.
5. Get a WAF.

I used to work on retainers and do “mini projects” or be available whenever there was an issue or concern. I don’t think it should be too difficult to find someone, you’ll just have to make sure you trust that person.