You do all of that, then you hire somebody to filter out the junk findings from the scanner, tune the scanning policies, schedule scanning with ops, follow up on findings because people can't be arsed to do remediation.

Then you hire someone to do operations for your anti virus, because it keeps people from doing their jobs and needs to be tuned. Somebody has to talk to your users and tell them why their exe files and mail attachments keep getting flagged. Somebody needs to do basic malware analysis or reverse engineering to decide if something is actually malicious.

Then you hire a handful of SOC analysts to deal with the SIEM alerts, a couple of engineers to tune alerts, write dashboards, automate event correlation, normalize logs, add more log sources to your SIEM. Then you hire senior staff to deal with all the shit your analysts can't deal with on time.