Ability to program is a huge plus. I would avoid the certificate route.
To get a feel of one aspect of security, take the Matasano Crypto challenge: http://www.matasano.com/articles/crypto-challenges/ It is a lot of fun, and, particularly if you are interested in cryptography, will show you how to break stuff.
I actually started in security quite a bit older than 40.
It might take a bit of reading; http://amzn.to/cthr46 is a good start.
Ability to program is a huge plus. I would avoid the certificate route.
To get a feel of one aspect of security, take the Matasano Crypto challenge: http://www.matasano.com/articles/crypto-challenges/ It is a lot of fun, and, particularly if you are interested in cryptography, will show you how to break stuff.