[spydum]

absolutely this. most solid security people were devs with an interest who were given the opportunity to flip. the problem is employers want to pay below market prices, for someone who already has all of the skills they want. that just doesn't happen: those people command a lot more money. your approach is MUCH more practical (hire or transfer good interested devs internally, and train them up).

[wglb]

The hard part was working with HR to make the new salaries higher. Not a small task.