Start with a software inventory of what you have and think about how often that software is used or exposed to risk. You cannot defend anything until you know what and where your responsibilities start and stop. Now look at your reports for high and medium risk items found in that first inventory. Common Vulnerabilities and Exploits (CVEs) range from 0-10 with 10 being the easiest or most destructive exploit. If at all possible patch and remediate those items first, no matter how painful they may seem at the time.
Go down through your list from highest to lowest, red - yellow - green, however your reports are presented and continue to work through reducing your overall risk. Ideally you will be able to look at the current state of patching and vulnerabilities in whole numbers today and compare them to next month, quarterly and annually to check your progress. We call this a baseline but for now allow yourself the luxury of learning the patching priority from both a technical and political standpoint. It's not uncommon for business (stakeholders) to put patching for for business reasons because "it's not broke" or convenience if not indifference. Concentrate on those things you can affect and warn against putting patching off for later.
These thing only look impossible when starting but once you get started will continue to build on itself. Doing much the same with a newer position myself.
Just takes time to get your arms around it all.
Good luck!
