Hacker News Reader

I think either of your options would work. If you have in-house skills (yourself and/or another engineer), exploit them. If you have a trusted third party who can help, spend some time and money on them. If neither of those work and you feel you need to hire someone, do that (although I’d go with the other two options first). Also, as you undertake these audits, keep a solid record of documentation (questions and answers) as most due dil exercises will be made up of many of the same questions. Stock answers go a long way.

This video is about : "Finance as Strategy: When and How Startups Should Build a Finance Function" - a16z https://www.youtube.com/watch?v=ns9_OGz4SeE

But this could apply to any Function in the business.

I would argue, you need a security specialist at about the same time as you need a build pipeline specialist.