I think there are defense contractors that develop and weaponize exploits, rootkits, and so on for the government and while I'm sure some of that work was used

I think there are defense contractors that develop and weaponize exploits, rootkits, and so on for the government and while I'm sure some of that work was used in Stuxnet, I think anything specific to Stuxnet was handled by actual governmental agencies. The article names the NSA and an Israeli unit. As for recruiting, you wouldn't ever get recruited directly to such a project - you'd already need a TS/SCI clearance and to have proven yourself within the NSA. As for recruiting into the general field of classified cybersecurity, it's not too much different from any other field; they post job ads, scour college campuses, probably advertise at defcon, etc. Generally if you're getting hired without a clearance it's not for a specific position - it takes upwards of half a year before you get cleared and can start, at which point they figure out which project to put you in. As for the most talented hackers, keep in mind the subject area: Wall Street has very little demand for security researchers, and Silicon Valley's demand for them is minuscule compared to the government's.