Switching from Developer to Information Security

Few days ago, I had a discussion with a friend who is Senior Information Security Manager at a large, worldwide company that have a big IT department (hundreds of developers). His Infosec department is short in people and he wanted to fill the positions.

I asked him why he don't try to "recruit" them from IT department. That would be a great advantage as the developers already know the company, the vision and the products. He said that he tried different ways to attract developers into his infosec department but none of them were interested though the salary would be bigger and being in a small department, the cohesion would be stronger among colleagues. I've told him that maybe, his approach is not the best and that he should try new ways like showing how cool infosec would be (not just asking).

My question is: What it would take to convince a developer (you) to switch to infosec (appsec -- application security)?