My advice is to stay as a software engineer, and slowly move towards secure software development. 98% of the security world is complete and utter bullshit, and no one is interested in actually securing anything. Ever wonder why EVERY bank has terrible 2FA practices? It's because they don't care. Same with law firms, hedge funds, governments, etc. Yes you can get great job security with security, but at the end of the day you simply won't be producing anything of value unless you are in the top 2% of the field.
Secure software development is different. Go make high quality software for firms that write in functional languages and use advanced methods for ensuring high code quality and safety.
Source: I did penetration testing for four years, also served in a cyber position in the military. What a giant waste of my time that whole effort was.
> Source: I did penetration testing for four years, also served in a cyber position in the military. What a giant waste of my time that whole effort was.
But the money must've been really, really good.
Easier said than done.