Who do other large companies use as an outside cybersecurity firm to assess their cybersecurity program, controls and also have the capabilities to perform red team activities and adversary attack simulations?

We've had great success with Aon. We've used their pentesting services, red team services, and adversary simulation. The reports are always timely and actionable, and they employ some very talented individuals. 

We have used in the past Mandiant, Accenture, and Deloitte to perform cybersecurity program assessments. For red team activities, we rotate vendors each year and have used the same vendors as above.