I would start with a structural overview - from a design perspective, are separate parts of code well defined? eg do you have validation code, input and output functions etc which are used for those purposes throughout the codebase, or is every function individual? Do you have code which is functionally safe (often certain style constructions do not impact the security of data flow)
If you have a security wrapper which carries out authentication for every function, you can possibly shortcut review of those functions and just check for usage of the wrapper function, for example.
If it is a very large codebase, then you will want to run a tool such as Fortify (or others that @AviD will be able to name :-) to make a first pass at the problem, but all tools suffer from a lack of context intelligence. They identify based on typical signatures, so you will get false posisives (and possibly false negatives - which is why having a good overview can help you identify risks a tool won't spot)
The idea is that the tool narrows down the possible risk areas and identifies the vast majority of issues, as tools are relatively cheap, then a human validates and adds to the tool's output, placing it into the context of the application environment.
At risk of sounding overly commercial I would advise using the services of an experienced security consultant who not only knows the code review tool inside out and is fluent in Java + Oracle, but also someone experienced in business and security risk based architecture.