WordPress malware forensics / incident response specialist

Looking for a WordPress malware forensics / incident response specialist. I am not looking for basic malware removal or someone to just run a scanner. We have recurring reinfections where malicious code is being written into theme `functions.php` files across multiple WordPress sites. Websites themes are NOT the same. I would like to provide the website files and database exports to someone who can review them and help identify the backdoor, dropper, vulnerable plugin/theme, or other persistence mechanism that is allowing the reinfection. Ideal person has experience with WordPress malware forensics, recurring reinfections, PHP backdoors, WP-CLI, database review, and Linux hosting environments. Goal: identify how the attacker is getting back in, not just clean the visible malware. Further details will be provided, ideally we want someone to work with an export of the website at their end. Access to our hosting would be limited as it is on a managed wordpress platform, we do not have root access.