&gt; Have you worked as a consultant at one of the larger firms, like Optiv, Bishop Fox or NCC Group?<p>No I haven&#x27;t.<p>&gt; What professional experience do you have?<p>Over 14 years of web programming experience. Plus a few years of open source security research.<p>&gt; Have you found serious vulnerabilities and published them?<p>I&#x27;ve found and disclosed security vulnerabilities in basically every popular PHP project (at the very least, every popular framework and CMS). On top of that, several Android and Java app vulnerabilities.<p>Some of them were sev:lo (timing side-channels in application-layer crypto), but a few were sev:hi (trivial remote code execution).<p>&gt; Any bug bounties?<p>Yes, but I&#x27;ve stopped doing them. They aren&#x27;t worth the time investment.