If you do, be sure you're on the side that is intentionally trying to find vulnerabilities, not the side trying to defend against them.

The defense side sucks. You have to deal with security vendors that are eager to sell you snake oil. You have to actively fight against management that wants to save money. You have to fight against users who don't care about security.

If everything goes smoothly and you have no security problems, the bosses wonder why they even pay you. If you have a security incident, the bosses wonder why they even pay you.

For much of the last decade, my career seems to be more and more partnered with cybersecurity teams...I like the kinds of people, and i like partnering with such teams. I work so closely with such teams, and many of my peers/colleagues - both on the cyber teams and others not on cyber teams - have suggested that i should pursue a career in cybersecurity...they often say that i have the head for it...that i have a natural knack for actually working in cybersecurity...but I've hesitated and i can't always succinctly verbalize why. Well, i think you stated it much better than i could; the defense side sucks for the reasons you stated!!! :-)