Hamad was expelled not for finding the vulnerability, but for running Nessus against the system after he reported the vulnerability, allegedly as a means of checking to see if it had been fixed.

Young Hamad shouldn't have done that, and would be fired from any job in cybersecurity for doing the same thing against a client's network without authorization.