Yes, you do, particularly if you’re using cloud hosting (which most of us do) rather than your own servers or virtual private servers (VPS).
Most hosts provide some sort of firewall protection, but on cloud hosting the firewall runs around the cloud space, rather than around your individual website. That means that if any one of the possibly hundreds of sites you share that space with is hacked the hackers can then find their way to your site too – unless you have your own firewall installed.
Top rated ones are Wordfence (my favourite), All-in-one WP security and WP Shield. I don’t think there’s much to choose between them, so pick one, install it and configure it. It’ll take a little while to get used to how it works so expect to keep tweaking for a while but it’ll be worth the effort to keep your site safe and secure.