I am actually in a similar boat. I have done a lot of java work, and was active on the security side of things in my previous role. I mostly worked on compliance, but I did some pen testing.

I can see compliance not being friendly to remote where pen testing would be a lot more friendly.

I know security is a big field, but I would love to hear any insight that you have on it.