I started to pursue a Masters of Divinity, but quickly dropped out as I came to terms that my motivation was primarily to "have the upper-hand" in conversations. (Not to mention I can't set aside 6 years of my life for school right now).
Yes. We're undergoing this now, and it's a very involved process that should not be undermined.
We've looked into companies that help with this stuff, and usually it's around 50k to get setup, and a minimum of 20-30k annually to get "re-certified" with a SOC2 report.
There's a newer SaaS company that claims to help with this sort of stuff called Vanta. Haven't looked into them, but I've been meaning to. https://www.vanta.com/
Please understand that it's almost irrelevant on if your cloud provider has a SOC2 report. SOC2 reports are centered around your internal processes, your organizational procedures, how you store and protect data, etc.
Yep - the hilarious thing is even the most Agile/Sprint heavy consulting companies usually have to succumb to some Waterfall concept in order to provide an estimate or meet a fixed bid.
Don't bottle all of this in; it'll only build resentment.
Be humble, speak your mind appropriately and professionally, and after you've done so, lean on the tech lead and manager for direction.