It is hard to overstate the need for someone who hates rules, restrictions and limitations. You need to find someone who your HR department is going to hate. You need to find someone who reminds you of you in your younger more carefree days. You need to find someone you trust completely. Then you are going to put them in a cube and NOT BOTHER THEM. Throw them problems, tasks and direction but get out of their way and let them do their thing. Then let them pick apart every security decision and implementation you have. Ask them how they would get around it and how to mitigate that. Finally, when they tell you something is bad…believe them.