There are security firms that run periodic social engineering attacks against their clients, including phishing attacks. This is a service performed to both better educate employees at the client companies and keep them aware of new attacks, and to flag those who fail often. Someone has to come up with the phishing attacks, granted probably not an entire career right there.