To find the type people that you really want on your security workforce, one of the first things to remember is that a pile of certifications isn't necessarily as important as finding employees who will best fit in with your organizational culture

Damn, I just cleared my CISSP ... just kidding :)

You want people who speak about 'we', not 'I', because in my experience there is never a single hero in IT security

True for Corporate-Tamed hackers, but IMHO this shouldn't be a deciding factor. `Experienced` hackers generally come along with their ego and pride in knowing about technology.

I would also add "ethics" to this list...