On Software Testing:
If you sign up for Fortify-On Demand at http://hpfod.com, you will notice that there are a variety of offerings, the primary three being dynamic security analysis, static security analysis, and mobile analysis.
A few others such as IBM and Cigital mirror this model. All three of these vendors supply Software-Testing-as-a Service (STaaS) capabilities, but none of these are a penetration test. They are security-focused software testing. This is the best test automation in the appsec world that money can buy.
While I have not kept up with test automation in the quality space, all three vendors still perform software quality testing in addition to software security testing.
The best book on software security testing is "The Art of Software Security Assessment", and for software quality testing, "How to Break Software: A Practical Guide to Testing". I personally believe there are cross-over techniques one can utilize from one to the other. Web application security testing, with free resources such as the OWASP Testing Guide v4 -- or the book, "The Web Application Hacker's Handbook, 2nd Edition" -- is a distinct field, as well as mobile app security testing, where the book "The Mobile Application Hacker's Handbook" provides context. Again, I do believe that software quality testing knowledge aids the process. However, these books' methods will not turn your test into a penetration test and the tools/techniques employed will not turn you into a penetration tester.
On Penetration Testing:
Penetration Testing is a completely separate topic. I do not believe that many software testers, no matter how good they are, will make themselves into experts at penetration testing. There are many facets to penetration testing, including deep knowledge of apps AND networks (e.g., network engineering, network security), fingerprinting, enumerating, service identification, protocols, advanced-evasion techniques (AET), social engineering (e.g., spear phishing), watering-hole attacks (e.g., traffic-distrbution systems aka TDS), botnets (e.g., domain-generation algorithms aka DGAs), et al. The knowledge required for deep system analysis is rather uniquely specialized. I believe it is limited to only people who will stop at nothing to deeply understand and analyze every component down to the bit and pattern level. This requires an enormous amount of time and patience. One almost has to give up their informal-learning progression of app development or software quality practices in order to "switch" to the penetration-testing mindset.
The best way to become a penetration tester is to go through all of the Offensive Security and Corelan material, as well as attend some top-tier courses such as thes ones available at BlackHat Training. If you can attend several Derbycons, go through every Derbycon video on Irongeek, and understand 95 percent of the material as deeply as the presenters -- then you can make a mark in penetration testing.
You would not want to specialize in web penetration testing at this time. From a time period between 1993 and 2006, this may have been a worthwhile pursuit. The problem is that today there are many technologies in use, e.g., Java applets, Web Services, Ajax, Adobe Flash, Silverlight, WCF, Apache Flex, etc -- and these require the full penetration-testing knowledge. You can't get away with specializing in a world with wearables, IoTs, digital wallets, mobile devices, mobile apps, and all of these other integrateable components. Penetration testing must take a whole-system approach. It is driven by models and frameworks that focus deeply on analysis.
A true penetration tester can also take his or her capabilities "to the next level" with adversary simulation. The OPFOR would know how to employ analytical tools and techniques such as Red Teaming Analysis (RTA) and Multiple Scenarios Generation. In 2015, this means being able to bypass a variety of controls and countermeasures, as well as the human elements. These are risk hunters who hunt the threat hunters who hunt them. This involves much more than social engineering, network/web/app penetration, et al. It can go beyond even elicitation, investigation, TECHINT, FININT, and CI HUMINT. There are hybrid socio-technical systems models that can describe human, cyber, and physical elements. These dynamical models would typically integrate game theory, deception (i.e., simulation, and dissimulation), and counter deception.