You should start with a detailed risk plan, describing the key threats to your business. After you find specialists, install the equipment and set up the necessary software, you will literally be inundated with a huge number of notifications about potential dangers. Most of them will be false. And the task of your SOC is to learn to filter them out quickly.

A lot depends on the processing unit you are looking at. However, this is an expensive proposition, you need a lot of EDA tools. You are also looking at high NRE costs (which makes it a non-starter unless you plan to run large volumes through the factory). The way I see it, if you still want to use security soc, you should go with companies that have been doing this for several years and have a lot of experience in this area. You can, of course, learn everything on your own, but it will take you a lot of time.