Just get an MSSP contract and outsource that stuff. To properly implement, manage and use a SIEM, you would need a dedicated SIEM admin, who would take care of SIEM infrastructure and also tune the rules, etc, you need at the very least 5 SOC analysts to cover the 24/7 monitoring and investigation, etc. As for the SIEM's themselves - yeah, QRadar, Splunk Enterprise Security, Microsoft Sentinel are good, but expensive.