I used to be in security auditing. I don't know about market saturation – that would depend heavily on your location, as it often requires some face-to-face discussion – but I think for security the saturation is less relevant than your credentials. Once a company decides to spend some money on outside security, they tend to go for a name-company with good credentials and certifications such as approval for PCI-DSS compliance checking. Once you provide the needed services, your name needs comes up as one of the go-to companies. Reputation and word-of-mouth are pretty important. For instance in the CC and banking sector companies are very aware whose services are being used by other companies. No company wants to give a good chunk of money away on something as sensitive and invasive as security checks without being sure they're receiving quality service and not some random script-kiddie with an automated security scanner.

If your company (or the company you want to work for) floats up as one of the top security firms in your region, you will probably get a lot of business. If you start from zero with no reputation, you're going to have fight hard to get your name on the map.