From the outside looking in that's pretty much what I guessed: Lots of report-writing and little if any programming, but a lot of very talented and interesting people.

It seems like with the proliferation of bug-bounty platforms today, there's a fairly clear way to prove yourself and get in the door while picking up a little cash on the side. Heck, maybe just dabbling in bounty programs is enough to scratch the itch.