I myself am a static analysis guy; I mostly gave up dynamic reverse engineering ten years ago.  So these days, my process is usually to locate where my input enters the module that I am interested in, and then perform heavy static analysis to determine how my input manipulates the state of the program.  I have found some neat bugs such as information disclosure this way; however, I am undoubtedly a lot slower than my counterparts who employ a lot of dynamic analysis and dynamic input generation (e.g., randomized fuzzing).  What steps do you usually take to discover vulnerabilities in closed-source programs?
What is your vulnerability discovery process?
vulnerability analysis