Youve minimized login risk, but not any 0 days or newly discovered vulnerabilites in your ssh server software. Its still best to not directly expose any ports you dont need to regularly interact with to the internet.
Also, Look into crowdsec as a fail2ban replacement. Its uses automatically crowdsourced info to pre block IPs. A bit more proactive compared to abuseipdb manual reporting.
Yeah IT is intensely customer focused, either via direct support or project planning and coordination with execs/etc at the higher levels.
You have to have deeply arcane technical knowledge, but also at least passable social skills and patience to do the work well.