"some deeper security testing ... a security audit"

Sounds like you want to start with feedback from Wiser Heads about your architecture, rather than a hit-and-run pen test.