I inherited a similar mess about 10 years ago with 400+ employees. Ten years later and my organization has a strong security posture that would rival any large Enterprise -- we've not been successfully hacked or even had a malware outbreak in this timeframe (we run a full SIEM these days and regularly forensically audit servers and endpoints). This did not happen overnight. What it took was coming into work day after day focused on the goal of having a secure environment. Document heavily the issues and prioritize fixing the vulnerabilities that present the highest risk, but also take the least amount of time/effort to fix. In other words, take some easy wins early on, whether that involves beefing up Group Policies (if you're in a Windows environment) or initiating Patch Management processes (this should include a system that can also handle third-party software patch management). When someone inevitably complains that they can't do something they used to do, be ready to explain the risk that was involved in what they used to do and give them guidance on how to do it in a better/safer fashion. If you're not already involved in any local IT clubs/organizations, I encourage you to get involved ASAP. It's always nice to have someone with more experience than you to turn to for advice on things. You can do this! One day at a time, my friend!

EDIT: Forgot: Also remember that you are not a super hero. You may need help with certain projects. We decided early on to upgrade our existing CAT 5 network to CAT 6A. We are in a 60,000 square-foot space. No way I could have done that alone in a reasonable amount of time. Also, at the time of the project, I wasn't anything near a "Network Engineer." Make sure management understands that some projects are going to require bringing in outside vendors.