First of all, take heart. The skills you describe with game hacking will serve you very well in a career in reverse engineering. If you can do what you describe, you're off to a great start, and I imagine that many jobs would be available to you merely on that basis.
So now you run into the problem that confronts many hobbyist reverse engineers wanting to go professional: your expertise is kind of dirty. Take heart on this point too, as many hobbyists (e.g., crackers) face an even worse version of this problem.
The short version is that you need to parlay your existing skills into producing publications that won't get you sued or arrested. Leave the dirt behind; at least, don't publish it. I'm sure there are freeware, abandonware, and/or single-player, etc. games that you can hack that won't raise any hackles. Publish things like this on a blog and/or at conferences using your real name, and submit them to the Reverse Engineering reddit to gain some exposure.
Another piece of advice I can offer is to leverage your connections. It's not impossible that some of the people you know in the game hacking scene are doing that as a hobby, whereas their professional employment is already in computer security. Ask those people for help, and be prepared to repay favors if they can.
Furthermore, seeing as most jobs in reverse engineering don't involve hacking games explicitly (although similar skills will be utilized), it makes sense to branch out into the other parts of reverse engineering and show employers that you can in fact do those things too.
On the malware side, there are never legal concerns. See this question for places to get malware samples; bonus points if you publish your analyses in a timely fashion. For this, I recommend following the anti-virus industry on twitter and seeing what the latest threats are, or worm your way into one of the good-old-boy anti-virus sample sharing mailing lists.
Vulnerability analysis might get you sued, but that happens infrequently. Be judicious, practice responsible disclosure, and maybe use a service like ZDI or EIP if you're extremely concerned about the risks associated with disclosure.
Finally, employers in this space are more concerned with skills than they are with degrees and so on. So if you apply for a reverse engineering position somewhere, most likely what will happen is that they will give you some sort of challenge to determine whether you have the necessary skills. Therefore, don't be discouraged about applying to jobs if you haven't published anything; doing well on the interview challenges is looked upon very highly for obvious reasons. Nevertheless, I still recommend publication.
In summary: ask your game hacking buddies if they do RE professionally; publish, but don't publish dirt; diversify; and apply for jobs regardless of what the state of your published work is.