The security scan of the code is pretty quickly. From my past experience, the results are sent out within 1 hour of submitting for review.
Creating the false positive document and also fixing any code is the unknown entity here and the time to do this will depend on your code base.
Once you have submitted the false positives and the codebase for the actual review it can take 6-8 weeks for Salesforce to respond. If they fail your package then you get put in the queue again after you have addressed the issues. I would recommend setting a realistic timeline of 2-4 months to get a package through a security review, plus whatever time it takes for you to fix any issues the security review raises.