The secure your wordpress website Codex has an outline of what permissions are okay. File and directory permissions can be changed through an FTP client or within the administrative page from the web host.
There are numerous ways to pull this off, and many involve copying and FTPing files, exporting and re-establishing databases and much more. Some of these are very complicated, so it's important that you go for the one that is best. Then you might want to look into using a plugin for WordPress backups if you are not of the persuasion that is technical.
It's a WordPress plugin. They are drop dead simple to install, have all the features you need for a job such as this, and are relatively cheap, especially when compared to having to employ someone to get company website this done for you.
Install the WordPress Firewall Plugin. Prevent and this plugin investigates web requests with WordPress-specific heuristics that are easy to recognize attacks.
Utilizing a plugin for WordPress security just makes great sense. Backups will need to be carried out on a regular basis. Do not become a victim because of not being proactive!