You really have to either have or be an expert in the specialty of security. The site will be attacked. It is merely a question of how and when, and you have to be able to deal with new and innovative attacks constantly, based on whatever platform you're using and things you haven't even considered. Never mind DDoS mitigation and other things that can drive you off your hosting or wipe you out utterly.