It's not too late. Some of the most talented infosec people I've worked with came from other areas of information technology or software development. Who better to find the flaws than those who are familiar with how systems work or understand how the code may be written?