Re: Don't Forget Instinct
@Marilyn Cohodas - Disclaimer: I'm not a hiring manager, but I have particiapted in the interview process.
For me, I put the resume aside and I get right to the point. Start off the bat with a question that pushes the candidate into action. Tell them your company's datacenter architecture, how many servers, the OS ecosystems, applications and network, and maybe one or two known weaknesses. Now, the questions: "How do you penetrate our network and take root for at least one system in our datacenter?" or "How do you bring our datacenter services down such that our clients no longer have functional connectivity?" and "What recommendations would you have toward buttoning up our security?" How they answer that will tell you at least if they are 1) experienced in doing that type of thing, and 2) knowledgable beyond books and research. In fact, you really don't want someone (like me, for instance) who is widely read, but has never actually done the work.
The follow-up to this is actually putting the candidate down in front of a system with a decent toolset pre-installed, from penetration tools to interpreters (Ruby, Python, etc) and give them a flag to capture. Seriously - because I think that time is money in today's tech environment, and if you can't do what you say you can do, and do it efficiently and with intelligence, and demonstrate a knack for the work, as well as a passion for all the work entails, then why are you applying for the job?