I run a small information security consulting shop. I went from full time software developer to information security consultant about 8 years ago and I have not

I run a small information security consulting shop. I went from full time software developer to information security consultant about 8 years ago and I have not looked back. Consulting in particular is very challenging, and fun. We don't focus as much on physical penetration testing, but if it has bits, we will assess it and break it. Good software developers make the best information security consultants. I have conducted a couple of physical pen tests. It is a mixed bag. It is more liberating in some ways than banging bits, but it is also a little more boring for me. It is almost too easy once you get down to it, there isn't a lot of challenge in it like banging bits with big rocks :) (We are also, almost always, interviewing people for jobs as consultants, if you are really interested).