Malware removal and making our WordPress website fully safe

I'm looking for an experienced WordPress security specialist to help us investigate and resolve a security issue on our WooCommerce website. A suspicious piece of code was recently found in our functions.php file, which appears to be malicious. According to our hosting provider, the most likely cause is an outdated plugin or another vulnerable component on the website. What we're looking for is not just someone to remove the malware, but someone who can: - Investigate how the website was compromised. - Remove any malware and backdoors safely. - Check if anything else has been affected. - Explain the root cause in understandable terms. - Advise us on how to prevent this from happening again. - Help us set up a safer maintenance/update workflow. One important note: we intentionally stopped enabling automatic plugin updates because previous updates occasionally broke parts of the website. We'd therefore like guidance on a better long-term update strategy that keeps the site both secure and stable. If needed, we can provide WordPress, hosting and other relevant login credentials so you can perform an initial assessment. Could you let us know: - How you typically handle projects like this? - Whether you work on an hourly basis or with a fixed price? - Your estimated timeline and cost for this project. If the collaboration goes well, we'd also be interested in continuing with other improvements afterwards, such as website speed optimization and ongoing technical guidance. However, our current priority is resolving the security issue. Looking forward to hearing from you. Best regards, Wiel