Security in general seems to be doing fine (ask tptacek), but I'm not sure how large the market for really good pentesters is - you'll need to be a lot better than Metasploit etc, which is difficult, and will penetrate almost every network, which is embarassing to your employer.

You can make a fairly decent living running Metasploit and turning the results into a nice report, too - but that's not "penetration testing" (as it is/used to be understood.)