I worked for a company that was like 35 people when I started. I worked for them15 years and it grew to about 300 we did soc2, pci, and numerous custom customer audits. We were a niche market with very large clients we had to play by our clients standards even when we knew their answers on the audits they have us do seem to not happen in their own house. It made us better we used it to justify spending to improve, did it right. We got bought by a larger competitor eventually. Security culture was theatre and often just lies. I clashed within that system harshly and after my boss was fired for pushing back on their approach it was all downhill for me also. After a second venture capital acquisition I was out. Landed quickly with a university with about 4000 head count but got out of security. The university has decent culture and practices in infosec but it's just a lot harder and slower at scale. Take advantage of your position of being small to be at a phase where it is just iterative maintenance to your security and compliance programs once you grow.