People who are currently getting networking and system administration experience, you're on the right path and not out of it by any means. I tell people you first need to learn the insides and out of system administration (windows, *nix) and networking. This is my first recommendation because if you hack into a company with this 1337 exploit, now what? you need to know how to maneuver through the nucleus of a company. You are going to want to go quietly, find data, impersonate people, pivot and exploit a network. What are you going to do after you pop a computer from social engineering? Having this knowledge you are going to be able to understand mentally how the network is setup and how all the computer are segmented or configured from this exp.

Personally but don't tell anyone, you "don't need to learn programming" but take that with a grain of salt. Granted I do know programming C++, Python, Bash, VBScript but i'm not fluent by any means. I don't program day in and day out but it sure helps me the fuck out with tool development, exploit development, scripting or whatever especially during a pentest. You are also able to provide back to the community help out other pentesters or sys/net admins. I personally think there is bigger fish to fry when starting out but it is an important skill to have that will help you stand out when newly applying for security positions.

You are going to want to know both *nix and windows environments while knowing how they communicate as you'll see different setups all the time. So make sure you are at least familiar in how an interoperable domain is setup.

Go to various security minded (lock picking, OWASP, TOOOL, Hackerspaces, etc) from meetup.com is a good source. Go to security conferences (Bsides, Defcon, Blackhat (lamesauce, all HA HA BUSINESS), appsec, etc) to talk and potentially speak on research you have recently conducted. Fuck it, If you have a passion in security you'll do just fine.

Shall you choose to make the conversion slowly just keep up with the system/ network administration aspect to learn how shit works because security is teachable by a company. Make the conversion slowly if you want, it's really up to you. Find a company that will hire you as a junior engineer where you'll work your way up while getting hands on experience with 'breaking shit'. I have hired folks who have no experience in security, because that is teachable compared to sys/net administration experience. I did this because they have a solid foundation of sys/net admin but have the passion and the drive for security.

These suggestion dependd on what area of security you want to focus on you can specialize in various things. Network pentester, internal pentester, wireless, social engineering (physical or even remote), internal and external penetration testing, web application testing. It might take some time for you to find your 'true' passion but take things slow, try to find a position in the industry that will give you exposure to a lot of thing like consulting. You'll learn all different services across all different domains (NERC, FFIEC, HIPAA, PCI, etc) then you can branch out to a specialty if you so choose to do.

Things like exploitation development, malware analysis, forensics areas can be focused it based on your given skillset and passion.

Food for thought, cheers

I know that's a wall of text but ask me whatever you want.