Fairly recent I started participating in Bug Bounty Programs.
Found my first bug in Yahoo; a out-of-scope SQL injection.
Got paid for the first time for something security related.
Later I found a Refleted XSS in OLX accross multiple domains.
Got mencioned in their oficial Hall Of Fame.