A good security guy (not someone who just has a ton of certifications) is very expensive. If you have to ask, you don't need one. That is unless your partners or clients demand one or you screwed big previously or you're in business under threat (e.g. of Chinese government interest).