Perhaps when you get more than "a few years" of experience, you'll notice that there's significantly more to the field of information security than application

Perhaps when you get more than "a few years" of experience, you'll notice that there's significantly more to the field of information security than application security. In many of those other areas, programming is at best peripheral to competence in the job. Source: 30 years of security consulting and entrepreneurship, without being a developer.