I talked to a guy a few years back that used to do this as his full time job, but the constant law-suits that ensued drove him to stop doing this kind of pen-testing altogether. most companies just hired them to check off a list and when the security firm actually found something the client would try to sue the pants off of them for "violating there systems" even they they had full knowledge, signed forms, etc... too much hassle for them...

i personally would love to do this kind of work, legally breaking into a system to see if it could happen would be very entertaining.