The distribution developers are doing most of the work for you. Unless you're using third-party repositories, everything you can install through your distribution's normal package management software has been vetted by dozens of people before you could even get to the point of installing it. On top of that, the default settings are generally reasonably secure to begin with, and it's often pretty easy to secure things further by yourself.
Beyond that, it's just about the same good security practices that you should have no matter what OS you'r using. Don't install untrusted software, don't follow random links, don't browse sketchy sites on the web, etc.
If you're really paranoid about malware, you may want to look into ClamAV, the only major non-commercial AV software for Linux. It's usually not worth bothering with though unless you're doing things that are particularly risky in the first place (IOW, if you never got anything but false positives from your AV software on Windows, you almost certainly don't need to waste system resources on AV software on Linux).
Also, it's worth pointing out that Linux is not inherently more secure than Windows, at least for smart users. It's a bit easier to secure properly, but that doesn't make it inherently more secure. The reason it's touted as having so few viruses is because desktop Linux users aren't attractive targets for hackers. This is, incidentally, the same reason that macOS has so few known viruses. Put simply, Linux users tend to be smarter on average than Windows users, or at least less lazy, and thus tend not to be fooled by malware as readily. That, combined with significantly lower usage on the desktop means that it's just not worth the time to attack desktop Linux systems.
This doesn't mean that people don't attack Linux systems though, such attacks just tend to ignore desktop Linux systems because they're usually not attractive targets. Most of the malware focuses on tight-embedded systems (like Android) or servers, because Linux easily outnumbers Windows by multiple orders of magnitude in both areas. It's not unusual for Linux server systems to see hundreds of break in attempts a day (put in perspective, the company I work for is tiny, extremely niche, and in general bot really a big target, and we still see over a dozen failed attacks an hour (almost 300 a day) against our servers).