I just started my first official cybersecurity position at a medium size company in an industry that is currently being heavily targeted with ransomware.

I'm starting pretty much from scratch as they have not had a dedicated security role in over a year and my predecessor didn't make much progress. So far i've been focused on inventory lists, policies, and procedures for hardware, software, and data. I think we're doing okay with minimizing stuff thats internet facing and patching is in a good place (well, at least with the devices and os's that are still supported).

Any suggestions on where to go from there or what to prioritize?