How do I tailor hardening for our Linux public web server and validate it?

[PatrickC]

I'm a junior sysadmin tasked with hardening our company's new public-facing web server running Linux, and while I understand the basic principles like disabling root login and configuring a firewall, I'm overwhelmed by the depth of potential vulnerabilities and the fear of missing a critical step that could lead to a breach. I've been following a generic checklist, but I'm unsure how to tailor server hardening for our specific application stack or how to validate that my configurations are actually effective beyond just not seeing immediate attacks. For experienced administrators, what are the often-overlooked hardening steps beyond the common guides? What tools or methodologies do you use for continuous security assessment and compliance auditing to ensure your hardening measures remain effective after software updates and configuration changes?