Well, for one, don't allow people to get masters degrees in security if they don't know how to run ls. Met a guy like that at my last place...

Next, hire more security people who just want to take things apart. There's this weird culture around "oh no, he's a hacker" that prevents legitimately curious people from getting into security. It stinks.

After that, realize that your federally mandated audits are bullshit. They don't catch anything.

Then, hire a pentester to try his damnedest to break in. Forbid them from using paid-for tools and give them a chance to learn, but hire someone else afterwards if they're not able to do the job. Yeah.

Once you're done there, realize that your security is probably going to fail eventually, and just do the best you can with a good team of security experts and actually listen to them. Emphasis on the fucking listen to them.