What are the advantages and disadvantages of having an internal pentest department in a large company compared to external service providers?
The most-effective use of a security professional who has penetration-testing skills is to host cyber exercises. Some are referring to this as purple teaming or adversary simulation. Each approach will be unique to an organization or set of organizations -- and have their own advantages and disadvantages.
I don't think it matters if you hire externally or internally for this sort of work -- the benefits of hiring someone internally have historically been discouraged because the individual would "likely become bored", "become predictable", and become less effective because his or her knowledge of the environment would prevent seeing things from a new or fresh perspective. However, with cyber exercises proving their value in Security Operation Centers, fusion centers based on cyber threat intelligence, and internal red teams -- the value of having in-house penetration skills is rapidly rising.
There are a few resources I'd like to point you towards in order to fully comprehend the tradtional and non-traditional approaches to penetration testing resourcing. Two books, one: "CISO's Guide to Penetration Testing: A Framework to Plan, Manage, and Maximize Benefits", and the other, "Effective Penetration Testing" by Kevin Pescatello and Matthew Larsen. In the former book, chapter 5 covers four types of tests: parallel shared, parallel isolated, series shared, and series isolated. Each of these test approaches include two types of outside penetration testers as well as one internal type -- blending a mix and balance of requirements and needs.
Lastly, I'd like to note that penetration testing is an emerging and changing field with a variety of expertise coming from many unorthodox approaches and a myriad of backgrounds. Having been introduced to US national intelligence, national security, and military TTPs such as wargaming, OPFOR, red teaming analysis (RTA), game theory, simulation, warning intelligence, S&TI, TECHINT, all-source intelligence, counterintelligence, MILDEC, counter denial, counter deception, analytical frameworks, and the fusion center model -- I have concluded that the penetration testing industry is due for a total rewrite. These antiquated third-party assessments that produce reports have always been laughable when compared to warfighting, so it is precedent that we embrace change, particularly due to this 2014 cyber war and the total cyber risk situation we are facing as a global economy or in the geopolitical space.