First, what is the goal you are trying to achieve? The various security services like penetration tests, vulnerability assessments, and "ethical hackers" are not simply "buying more security." You have to have a goal in mind; the basic goal of this kind of expenditure is to discover vulnerabilities in software, networks, processes, and procedures. This is important: in order for an audit, assessment, or test to improve your security, you will need to do something about the findings. This almost always means spending more money, whether on software, personnel, or insurance. You should have someone on your staff whose responsibility is security; they should have the technical chops to call bullshit on security vendors as needed, and the integrity to track vulnerabilities and advocate for security improvements in all areas of your business.
Second, and closely related, don't pay for information you already have. If you know you have a particular security problem, don't pay an "ethical hacker" to rediscover it. Spend that money to fix the problem. If the test is mandated anyway, be honest about your known vulnerabilities up-front. A good tester will be able to tailor their assessment towards areas of unknowns in order to maximize your investment. Consider rotating between assessment types to maximize coverage. Do a black-box external penetration test, then an internal test simulating a disgruntled employee, then a targeted white/gray box test of your most critical systems, etc.
Third, invest most of your time and effort in the test before it occurs. Research the security service provider, including checking references, not just certifications. There are lots of frauds and shoddy workers out there. Ask to see examples of their reports. If it's not actionable information, why pay for it? Ask to see their testing methodology. If they balk, bail. If they don't have a repeatable process, you can't be assured of a thorough test. A vulnerability scan with Nessus or Retina is not a penetration test; don't pay premium prices for cheap services. Get heavily involved in the negotiation of test scope. The more you free the hands of the testing team, the better and more realistic results you'll get.
Fourth, for penetration tests, make sure you're paying for a test that emulates a realistic threat. Dan Guido of Trail of Bits has done some excellent research on intelligence-driven defense--knowing the threats your organization faces and optimizing your defenses to them, rather than just blindly spending money on what everyone else is doing. Check out their papers on the Exploit Intelligence Project and Attacker Math. It's simple enough that you can perform a preliminary analysis yourself, then use it to fact-check the claims of teams that are trying to sell you their services. Trail of Bits even offers consulting in this and other areas. (I am not affiliated with Trail of Bits in any way)
Finally, don't buy into the hype over the word "hacker," especially with the "ethical" part attached. There are certifications that indicate some basic level of skill, but opinions in the industry vary widely; let "ethical" be demonstrated by a person's behavior and references, not a certification. A person does NOT need to be "reformed" to have skill; don't exempt someone in this field from any background checks, criminal or otherwise, that you would hold your regular employees to. Security testing isn't "magic," and poor work habits are not an "eccentricity" that goes with the territory. You have the right to expect the highest ethical responsibility and integrity of your security testers as any other position, if not more.