Learning Security QA from the Vulnerability Researchers