Burp Suite Pro is indeed the tool of the trade when performing penetration testing of web applications. I would however not call it an automated tool.
While it contains some automated test functionality (Active Scan), using this functionality will by no means give you a conclusive answer on whether there are vulnerabilities present in your application. As an example in my case, I use Active Scan together with other tools and techniques to perform attack surface analysis, so figuring out interesting parts of the application that can receive some priority when looking for bugs.
I would strongly suggest to enlist the help of a professional security company to perform the security assessment and to also verify whether the application and system in question has been compromised in the previous attack.
That being said, I do indeed think it's a good idea to use tools like Burp during the development cycle, and also to invest in secure development training.
I suggest you start by having a look at the OWASP Top 10 and the OWASP Testing guide. Also read the Web Application Hackers Handbook 2nd Edition and learn how to use Burp Suite Pro.
I personally have not taken GWAPT so cannot comment on it, but the OSCP certification from Offensive Security is well regarded.
Good luck
Outlines the different security priority, as mentioned above Burp is a great tool for web app testing
Good luck!