A bunch of friends just look for and then sell vulnerabilities (the good ones to bug boundary programs the less ethical ones to governments or companies).

The price of a zero day exploit is quite high (for both sides) and I have friends who make much more money than I do doing this.

That said they mostly work alone or in small groups in their basement rather than at a large security company.

I would hire (or at least interview you) with a prior conviction though I am not hiring for a security role.

I don't think the conviction is a serious impediment for employment in this particular field (since it's for a non-violent crime) though it might warrant supervision on your employer's side and I can definitely see the larger companies not wanting to take the risk.