Usually good consulting companies would hire former SWE that wants to switch to security. During interviews, basic security questions are asked, most are covered under security+ certification. But companies might skip asking them and instead ask SWE code related security questions instead. Such as how to prevent OWASP top 10 vulnerabilities. Most of the major ones are covered here https://cheatsheetseries.owasp.org/Glossary.html

Code review job would involve running commercial tool such as checkmarx or fortify and then reporting on issues that tool finds.

For web application testing these two sites are a good start. https://portswigger.net/training and https://www.pentesterlab.com/pro Most web app testing is performed using this guide https://owasp.org/www-project-web-security-testing-guide/ Hands on is the best way to learn web app testing.

Companies give you 24-48 hours to test vulnerable web app. After you send them report with findings if they like they have final interview round.

Some of the better companies are ncc group, bishop fox, nettitude, google certified security companies and others. You can find them as sponsors on security meetups like bsides.

Some of the more technical ones are https://cure53.de/#publications. You can read their reports. Also https://www.trailofbits.com/

As for pay it’s decent but the ceiling is lower than SWE. Entry level positions usually make below 100, senior low 100, manager mid 100 and more senior positions are around 200. After that it’s harder to move up.

Lastly the job itself can get pretty boring at times. Code review is something most people try to avoid. It’s useful when combined with web app testing to perform greybox testing.

Web app testing can be boring as well, when testing multiple web apps in a row that were tested multiple times and not finding anything decent.

What makes up for all of that is excitement from testing newly developed or older web apps with lots of vulns, performing network pentesting and developing new tools for different projects.

It’s a great feeling when you publish a new tool and lots of people start using it and appreciate your work.