I went from lead dev (and head of development with 10 years experience) to security consultant about 6 months ago, as security was always a hobby of mine.

If you look at my previous comments I always say the same thing: get the OSCP certification. It will definitely get you an interview but the course is hard and demanding.

Also, get ready to take a paycut and a role downgrade as 4 years of pentesting have more value than 10 years of development.

Obviously you bring other skills to the table like better client communication and knowing how things work under the hood, but you'll have to take a step back before you take two steps forward.

I definitely recommend you go that way, but think hard before you do, and please be sure it's not because you're "bored".

Last but not least, prepare to travel to clients. Sure there is the "internet" and "vpn" but a lot of clients have internal apps need testing and do not give you remote access.

If you have any questions I'll be happy to help out.