TL;DR - Being professional and humble will go a long way. Being secretive, prideful, or malicious will obviously not end so well. If you calmly and privately work with them, they're likely to do the same.
This sounds almost cut and paste to how I started finding issues with my university's security. My university was putting the student's ID in a cookie and that's who you were signed in as. If you manipulated the cookie, you signed in as whoever you wanted. It was the discovery that led me to look deeper into their security. They also had an insecure mail server that would relay anything without authentication. The filenames of the images in the school directory were just a weird encoding of that student's ID. At one point, I could look up an SSN and get a student's name.
I found these bugs a little at a time. It started with a sense of "My information needs to be safe and it's not" and I would point out the latest flaw I discovered to IT. After about the 3rd time I reported something, I began feeling both angry and superior to the department. Every other week I'd be in the Vice President's of Technologies office pointing out a new way to get SSNs or financial records of students as far back as 1995 or some stalker technique to determine somebody's entire class schedule (including their letter grade in that class). The VP also began to get hostile with me. I admit I may not have had the best attitude after the 6 month mark. At one point I was expelled for about 3 weeks when they heard I was trying to reverse engineer their encoding (linked above). I wanted to show them what holes were vulnerable when an individual wasn't working with them and they were in the dark. Eventually we sorted it out, but there was a lot of anger, paperwork, and ego going around in the mean time on both sides.
The point I'm trying to make is that the IT department worked with me despite me being a jerk. They fixed the problems and the school is better off for it. As long as I was upfront about my intentions and open about what I was doing, they didn't threaten me or hinder me. It wasn't until I was working in secret that they took disciplinary action. I was all over the board with things that absolutely could be considered hacking including injection attacks, social engineering, reverse engineering, packet sniffing, port scanning, custom software exploits, and more. Since I never changed anything and always (well... usually) reported my findings quietly and directly to them, they worked with me. I have no doubt that if I wasn't an ass then I wouldn't have been temporary expelled.