No security reviews. What a mess.

I recently started a Sec Eng. role at a mid-sized software company. Never seen such a mess :(. We have a few basic code scanning tools in place, but no structured security review process. Any suggestions on how to build a program around building secure products?

basic build building code code scanning cybersecurity eng process products program review reviews role scanning sec security software tools