Is hiring a hacker ever a good idea?

People often talk about a skills shortage in cyber security - could hiring those with a murky past be the answer? Or is it too risky?