The annoying truth is that offensive security roles, despite being the "sexy" face of security, are in much less demand compared to defensive security roles. Th

The annoying truth is that offensive security roles, despite being the "sexy" face of security, are in much less demand compared to defensive security roles. There are some very prestigious pentesting or research shops that pay a lot for highly-skilled offensive security professionals, but they are rare. The average company treats offensive security as an entry-level position meant to attract newbies to security with the "sexy hacker role" before pushing them into more in-demand positions like application security. For context, many of the large companies I consult for have ~5 people max on their red teams, while having 100+ on the rest of their security teams (the "blue" teams). There just relatively aren't that many offensive security positions available. If you really want to do security, then my advice is to either look at some dedicated security consulting shops that do penetration testing (and be prepared to take a pay cut), or alternatively use your software development experience to pivot into an application security role. From there, you might find it easier to get involved with some offensive security efforts through that.