Yes, generally a security audit is worth it. I am bias as I am a security engineer and have pentested multiple companies during my career.
Theres a cost saving by designing things up front say for GDPR or handling credit cards safely that is worth investing in. Sometimes, a threat modeling session alone could save you time and money in the long term. It's harder to change things when you've built a product, have customers relying on it.
In terms of the actual product, you will have users, they will need to login/logout/reset passwords. Ensure proper authorization and authentication.
How are you handling logs, secrets, 3PP. Do you handle customer input, do you reflect it onto the page, store it in the database? Do you allow them to do HTTP requests? How do you prevent SSRF.
How are you protecting your code? Laptops? Do you have antivirus? Do you patch your infra?
These are the questions you don't really think about, however they can have real consequences if you don't.
In terms of who I'd recommend, you get what you pay for. Generally, I'd look for a small shop in your local area and vet them.
Yearly pentests are a +, and if you do go through an Acquisition or someone trying to whitelabel your product they will want the reports.
If you don't have any revenue yet, do check out OWASP top 10. Run scoutsuite on your AWS/Azure/GCP. Enforce MFA where you can, Github/AWS/Gdrive/O365. Setup SSO right away and just use that to login to all your infra and services. Will save you so much headache down the line. Make sure you keep your logs application and service logs. Try to aggregate them somewhere.
