I'm running my mail server on Arch Linux since 2011 (so since Arch was in its quite early days) and I applied principles outlined within CISSP. Particularly I was focusing on reducing plane of attack to absolute minimum, ensuring I know exactly what each config option results in and keeping my server up to date. This has served me well and let me go through more than a decade.

I see some posters saying it's not good practice to run Arch, but I think distro alone is not an answer to your security concerns.