tptacek's approach to finding good people is fairly well documented, as it happens. I'm sure he can jump in and summarize it better than I can, but in brief: his company has several pipelines which generate quality candidates for the type of work his company performs (he is a co-founder of an application security consulting firm; the pipelines are a series of crypto challenges that are designed to teach you how to implement and how to break common crypto algorithms, and www.microcorruption.com, a ctf that teaches you to reverse-engineer assembly code and craft malicious payloads to take advantage of legitimate exploitable code, while defeating legitimate exploit defenses). These pipelines are, according to tptacek[1], very good at producing candidates who are interested in security work and are capable of doing same, regardless of prior experience. He has also refined his interview process in an effort to generate quantifiable and comparable information about each candidate, as opposed to e.g. asking candidates to solve brain teasers because it makes the interviewer feel smart.

[1]: I'm phrasing it in this way not because I don't agree with him, but because it's new enough that I don't think it's been established as objective truth. I'm of the opinion that the pipelines are very cool and fairly effective as recruiting tools.