You realize that offensive web application pen testing is only a tiny corner of the whole information security industry, and that most information security professionals don't find bugs. A good portion of InfoSec professionals are not technologists at all. They are behavioral experts, legal experts, policy makers, etc.
Judging by his own description of his skill set I would say he doesn't do offensive security at all but rather remediation, policy, and/or maybe forensics.
Judging by his own description of his skill set I would say he doesn't do offensive security at all but rather remediation, policy, and/or maybe forensics.