I have worked with following consulting companies NCC Group, Security Innovation, and Coalfire in the past. All of them are pretty good.