The #1 thing I'd recommend to people going into InfoSec is a contant drive to learn things. For the HN crowd this is a given, for the non-HN crowd many people

The #1 thing I'd recommend to people going into InfoSec is a contant drive to learn things. For the HN crowd this is a given, for the non-HN crowd many people like to become experts in things and then be able to use that same expertise for years. In InfoSec regulations are constantly being changed or updated if you're an auditor. If you focus on application security from a code perspective you'll constantly be learning new languages and frameworks. If you focus on network security new attack vectors will constantly appear and need to be mitigated based on new services, protocols, etc. For the non-auditor roles you'll also really need to enjoy puzzles or figuring out the solution to a problem given a non-obvious set of complete information (think multi-variable calculus, you can figure out what X is but not without a lot of work). I spent most of the past decade in the space. It is fun but it can be frustrating for the technology purist. Business isn't always interested in doing what is the "best security" -- they'll want to do a mix of compliance (which is the practice of security controls to meet regulations a business has to follow -- these may add no "real security" at all when implemented) and then enough security to minimize the risk; not often enough to really eliminate it.