What seems to have happened in this case is that Arciszewski stumbled unawares into what is in fact a cut-and-dried CFAA violation. Contrary to extraordinarily widespread and dangerous popular belief, it is not lawful to test random sites on the Internet for security flaws. It is unlikely to ever be lawful to actively exploit flaws on sites without permission. Arciszewski POC'd a serious vulnerability on a site, and had the misfortune and poor judgement to do so during the middle of a huge law enforcement shitstorm.

If that happens to you, I think the impression you don't want to create is that you vigorously contest the criminality of your actions. That impression comes freighted with the concern that you might think exploiting vulnerabilities without permission in order to make a point on Twitter is a good idea. That concern is, to many employers, both valid and relevant.

Instead, I think you want to create the impression that you've learned that the standards are strict for not messing with other people's systems without permission. And that you've learned better than most other professionals that systems in production are not to be trifled with out of process. And thus that of all the people a firm could hire, you're among the least likely to cause outages and disruption by making dumb out-of-process changes.

For whatever it's worth: if you want Exhibit A for why I don't have a lot of sympathy for people involved in "Lulzsec": breaking into sites and circulating credit card numbers and dumping databases created a set of circumstances that law enforcement absolutely had to respond to, and that's what sets up the crossfire that undisciplined but well-intentioned bug hunters get caught in. The people who go beyond doc'ing vulnerabilities to dump databases and take down sites are in some sense ruining things for everyone else.