A security hiring strategy that I preach and practice: If the choice is between an (a) expert in the system we are securing with little to no security expertise and (b) a security expert with little to no system expertise - choose (a).
@vinoth when people ask me how to get into security, i tell them to go be a sysadmin for 2-3 years
