[wglb]

No, not too late.

I actually started in security quite a bit older than 40.

It might take a bit of reading; http://amzn.to/cthr46 is a good start.

Ability to program is a huge plus. I would avoid the certificate route.

To get a feel of one aspect of security, take the Matasano Crypto challenge: http://www.matasano.com/articles/crypto-challenges/ It is a lot of fun, and, particularly if you are interested in cryptography, will show you how to break stuff.