If you get the CISSP and are a good manager you will most likely end up triaging bugs and not actively testing. This is a compliant I have heard from new members on our team. Security isn't always sexy, and people actually get pissed off at me for breaking shit and halting releases. At the end of the day too, no one gives a shit if I break into a box, they just want me to tell them it's secure enough today. It can be a thankless job sometimes.

You don't need a SANS class, they can teach you a lot but there are places for newbies that get more for much less. It's better to get a job and see what they need you to do on a daily basis, then choose a SANS class to get better at that specific skill. I'd just put your resume in now as a sysadmin and see what happens. We hire plenty of people with devops/sysadmin backgrounds and teach them as we go.

Certifications are pretty much not required. Some are seen as a joke and will actually get you weeded out if they are on your resume.

Compliance is very... very dull and is seen as a joke to serious security folks because the bar is set very low. I would say avoid this completely if you want to enjoy coming to work. (Sorry for compliance folks out there)

Six figures is common for a lot of people on here. Security makes more than some software devs depending on your skill level and company. I don't know what you do now, but you would most likely be matched or higher depending on how strong your skills are.

I'd say the hardest thing is you always have to learn new technology and keep up to date with the latest trends. CI/CD pipelines, containerization, blockchain (rolls eyes), cryptography, different cloud environments, smart phones, cars, etc. You will almost definitely encounter something you have never seen before and need to learn as much about it as possible in order to secure it.