There is no true answer for this as far as I am concerned, it is different for every person that attempts it. If you have motivation, a good personality, and aptitude for the topic, you can pull it off. (i apologize for the TL;DR elaboration)
I guess my situation would somewhat follow this question, but then again I threw going to university into the mix...
*I'm a current student at Rochester Institute of Technology. Initially coming to RIT, I was very interested in programming as well as security, so I entered the Software Engineering major.
After a year, I transfered to the Information Security and Forensics major looking for a more hands-on career. I proceeded in taking every security related course I could, which gave me a very good background, though this will be a pain for my last school year (which will be made up of only liberal arts courses).
During my time at RIT, I constantly worked on professional networking (networking with other professionals, though I did end up doing a lot of physical networking too) and experimenting with any technology I could get my hands on along the way.
One thing that I believe give me an advantage was my involvement in clubs. I was an extremely active member of a video gaming club (don't knock it, it is/was the largest club on campus; We would run 200+ person LAN parties), an active member of SPARSA which is a student run security club, and some other music related clubs.
With this degree it is required that you have at least 3 quarters (3 x 11 week blocks) of co-op (paid internships). My first co-op was as a system administrator at RIT. Because of my schooling and my contacts, i was able to land my second co-op (6 month contract position) with the company I am working for now. I work in two different security departments and it gives me the opportunity to take part in their penetration testing practices as well as may other aspects of of the security industry.*
Many of the articles and books I have read regarding professional penetration testing seem to agree that a proper pen test team member is a security professional with 15+ years experience in the IT field. I would love to say that I fit that bill, but i definitely do not. I'm simply an undergrad student with no certifications, but I'm working on the same team as those very experienced professionals.
If you are a security enthusiast and do not necessarily have the professional experience to get your foot in the door, I'll tell you what I believe helps (or at least what has helped me).
First, There's no reason not to apply to any security jobs if you're interested. Don't let the thought that a lack experience or skill sets may hold you back. What's the worst that will happen? they turn down your application?
Second, Constantly network. Get involved with the security crowd, or even the general IT crowd. Something as simple as being in a video game club that runs LAN parties may inadvertently help you out. Additionally, every job interview is another chance to network. Make a good impression, even if you don't fit the bill at that time, it's always a good thing to have people recognize you (even better if it's at a security convention or something to that effect).
Third, Do research and show that you are a current contributer to the field. Working with opensource projects and going to conventions are things that one can do without being a current security professional that are also great topics to discuss in an interview. Things as simple as being involved in a security forum (or hey, maybe this stack exchange) will give you discussion topics. When it comes to penetration testing, remember that knowing how to pop a box isn't the only hurdle. Demonstrate that you have an understanding of the whole picture (legal issue, reconnaissance, risk/threat evaluation, vulnerability management, technical writing, etc).
Forth, emphasize a willingness to learn. If you don't have the experience, make sure that you convey that you are looking to gain that experience.
So, those are just some thoughts I had while reading this question. This situation has to have a lot of aspects perfectly align. The personality and position of the interviewer/perspective employer (if the interviews are conducted by an HR person who has a list of reqs in front of him/her then you're out of luck) and the heiring climate at the company also have a lot to do with the situation as well.
Certifications help, but are not always needed. Some companies give them a lot of weight, while others will put much less merit in them.
As for published papers, if you're able to publish papers, then i would assume that either you're scholar or already a professional. Either way, you should already have a foot in the door.
I would like to end with one final comment, i have seen a growing trend in companies heiring fresh recruits so they can build the employee into someone that suits their environment and their needs. Why bring in a person that the company needs to break of their old ways when you can being in a newbie who you can mold from scratch? Granted that this is much harder to apply to the security field, but it is definitely applicable to most other fields and i'm sure that it has some bearing in security.
I would have liked to better formulated this response, it feels very scatter brained. Also, i apologize for any spelling or grammar errors. I'm happy to clarify my comments, answer any questions, or take any berating if anyone is so inclined. :-)