You have been hired as the senior security lead for a growing company that has never had a formal incident response program. They have experienced two significant breaches in the past year that were handled poorly. Describe your complete strategy for building an IR program from scratch, including quick wins in the first 90 days, team structure, tooling, processes, and how you build organizational buy-in.