Finding exploits and performing a security audit are often very different tasks. A person that can do one is not always able to do the other. Companies, such a

Finding exploits and performing a security audit are often very different tasks. A person that can do one is not always able to do the other. Companies, such as companies that sell surveillance software to governments, do hire people to just find exploits, but judging by leaked emails that can be a stressful job as you are expected to regularly deliver new exploits.