Pretty much a lot of “training” in cyber security is a mix of best-practice and how to hack shit, so employing people who have experience in the field isn’t a terrible idea provided you can vet them.

After all, Mitnick started up a successful cyber security company and many others have hired people who have been caught doing clever but naughty stuff due to being curious and bored target than actual malicious intent.

At the least, you’d probably be more likely to get somebody who knows how stuff works as opposed to some of the “I clicked the scan button and ran a pentest report sorted by CVSS score” types who know jack shit about actually security.