I have done this jobs before on a hosting company, and on an few public institutions in my country. I recommend you that we handle it in three steps:
1.- Computer forensics: we need to find out what changes the hacker did on the system. how many files were added, how many were modified, files and folder with permits changed, It's the kernel corrupted?, how many scripts, daemons or processes are running on favor of the hacker? these and many other question will be answer because I can help you find all of them in no time because I have develop a few scripts to help me on this task.
2.- Hardening: After finding and neutralizing all the effects of the hacking we will start improving the security of the system carefully, deleting every possible vulnerability from the permits of files and folders, OS configuration, web server configuration and creating new settings that will improve the security from the inside. After this if you want to add more security by installing software on your server , like WAF or IDS (like the hosting recommends fail2ban, etc) I can do it for you.
3.- Web vulnerability detection: Now that your site is clean we need to make sure that It won't get hacked again any time soon, so I will start a web vulnerability test with the most uptodate tools and scripts in order to find out not only the vulnerability that the hacker used to get into your system, but to find every possible vulnerability it might have.