On the security engineer item, I think this piece falls into a common trap. It regards security work as mostly technical work, to be handed to an IC who can also handle technical questions.

As the company will probably lack a decent security roadmap and be poorly positioned to develop one, the right move is generally to hire someone equipped to do so. Which is to say a Director of Security. They will need that rank for the inevitable political battles with Product and Marketing / Sales. Those early political fights will do more than you think to shape the culture for years to come.