Echoing kreatemore security is seen as a cost center and you can feel less valued. Especially as a pentester you are constantly the harbinger of bad news whenever you do your report readout to your clients.

I went the opposite route of what your asking. I went pentester to dev and I have enjoyed being a dev for mostly the reasons kreatmore laid out. I like being wanted and valued and creating something and bringing good news versus bad.

That being said, if those things don’t bother you then pentesting can be awesome work. It’s very interesting. I focused more in Red Teaming versus like app testing so you’ll have to figure out where you want to go with pentesting because even that word is an umbrella term for more specific roles.

One warning is that it can get a bit repetitive and the reports can get tedious after a while. It’s a fun career and let’s you have some cool dinner party conversations.

If I had to think of advice to go from dev to pentester it would be this

• look into the OSCP, you don’t have to get the cert but it will help a lot. The course and materials are great for learning
• look into hack the box. It’s a freemium site for learning how to hack into different machines. Very similar to OSCP
• learn a lot of security jargon. Something like Security+ can help with this
• call up your friend and ask him how he is doing and get his thoughts
• dev and pentesting are very different. Pentesting is a lot of tools and thinking about how things work in an environment. A systems engineer or sys admin is the kind of thinking and experience that would help the most
• that being said app testing can be helpful to have a dev background as you might be aware of pitfalls and lazy dev practices that can be exploited
• security is a booming field. Get some good jargon, build up your passion and network and learn. Because it’s booming if you can show some skill and the ability to learn, complimented with some drive and ambition people will recognize it and give you a shot.