I'm about to relaunch my company's website using Drupal 7. I'm the sole web engineer in our IT department, so I have a lot on my plate as we approach the launch date. As this is my first major Drupal site, I want to be certain that it is as secure as possible. I have completed as many proactive security measures as possible, including following the secure configuration and the best security practices guides on drupal.org, I've subscribed to the security newsgroup, and hardened the LAMP server using industry best practices.
Now that I have completed due diligence with regards to proactive security, I want to run a security audit before we go live to be able to generate a report stating we are "as secure as possible" for management. I usually do all of the testing by hand, page-by-page, using the OWASP Web App testing cheatsheet; however, I'm new to Drupal, this site is hundreds of pages, and I have limited time.
What are your recommendations for security testing a Drupal site of this size? I have access to Rapid7's Nexpose Enterprise, so I will be using that for some automated testing. I do not want to use hosted scanning tools, but will consider security-audited tools that I can install myself to use. Do you have security checklists you go by, similar to OWASP, but specific to Drupal 7? Any other advice for things I might have missed are also appreciated!