I have some experience in software development, some experience with scripting and basic experience within devops (sysadmin, networking fields). Recently I've started a career in security (security analyst). I've been thinking that I'd like to specialize in some security field only. I believe the most appropriate for me would be either application security, either penetration testing.
How should I know which one should I choose without having to work for awhile in each of them? What factors should I take into account and what it important when making this decision?
For example, I'm interested in knowledge required, career path, job market, employee vs consultancy, work-life balance, salary ranges. But please don't limit to these ones if you think any other data would be useful.