Pay for “managed hosting” with a company like Flywheel or MediaTemple. They will often make security updates automatically and notify you of any needed plug in updates or other security concerns.
For content-related maintenance, create a content calendar either annually or quarterly and add any update tasks to your calendar (think new exhibits, events, or other time-sensitive updates). An hour or two of planning can make a big difference in chunking the work out and keeping it top of mind when you have many other responsibilities.