Learn the OWASP top 10

Use vulnerable VM's and practice like Metasploitable and https://github.com/SecGen/SecGen

Get the OSCP

I also highly recommend being good at some programming. This is for source code review and quick scripts/exploit development.