Meet the bughunters: the hackers in India protecting your data

In an international company, doing UAT type testing and investigation, it would be about average for an assistant manager, but the variance is vast, even between people sitting next to each other.

If that figure is per month, then he's really doing well, pulling in the same as an SVP in an international company managing a team doing a similar role.

We probably agree that vulnerability reports should be seen as a positive thing. What software owners should have are policies and procedures for transparently handling vulnerability disclosures. At most, I think having some flexible process should be required as part of a certification (PCI, etc).

I do think that knowledge of a vulnerability and lack of action to fix it in a reasonable amount of time, which results in a breach should be treated more seriously. At the same time, encouraging reports of breaches is hard as it is and introducing more punishment would make everyone want to just keep quiet or as ambiguous as possible. I'm not sure what a good solution to this would be.

If they choose bug bounties to help with this, good for them. If they choose other measures, also good too. They simply need to show they take effort to protect information as dictated by information security laws, or internal policy, whichever is stricter.