You're the IT head now: How would you build a secure, leak-proof IT infrastructure for a 100-employee pharma startup?

Imagine this hypothetical but serious situation:

You get hired by a newly launched pharmaceutical manufacturing startup with around 100 employees. The CEO admits they have zero knowledge about IT and gives you full authority and unlimited budget to build the entire IT infrastructure from scratch—from cabling to servers to software, security, everything.

However, there's only one non-negotiable condition:

“No matter what, company data must never leak. Even a single byte leaking will be considered your failure. I want bulletproof protection.”

The company has all traditional departments—HR, Accounts, R&D, QA, Sales, Production, Logistics, etc.—but no existing IT systems.

So here’s the question:

How would you design the entire IT and network infrastructure?

What technologies, servers, OSes, security controls, authentication, backups, DLP, cloud/on-prem mix, monitoring, etc. would you include?

Would you go full on-prem or hybrid cloud?

What would you do differently for a pharma company vs others?

How would you ensure zero data leakage, even via insiders?

Assume you can buy whatever you want—but you’ll be held fully responsible for future security breaches. How would you approach this?

Would love to hear from sysadmins, infosec folks, or anyone who has built systems like this before.