Four things, in this order, before anything else
Most institutions your size are sold the fourth thing first. Done in this order, each step makes the next one cheaper.
Stop the two routes that are actually used
Phishing against staff and unpatched internet-facing services account for most successful intrusions. Close those two and you have removed the majority of realistic attacks without buying a platform.
Protect the borrower data first
Not everything needs the same protection. Classify the borrower and financial records, then put database controls and leakage prevention around those, and leave the rest for later.
Borrow a SOC instead of building one
A twenty-four hour rota needs at least six analysts. Nobody at your scale can staff it. Managed monitoring gives you the coverage without the headcount or the tooling.
Satisfy the regulator with what you already did
Central Bank requirements and data protection law largely ask for evidence of the above. Documented properly the first time, compliance is an output rather than a separate project.
What clients your size ask for first
Managed SOC
Monitoring and triage without hiring a night shift.
Vulnerability assessment
A first honest look at what is exposed, before deciding anything.
vCISO and DPO as a service
The named role your regulator expects, without a full-time salary.