How do you recommend I transition my career from functional, requirements-based software testing and test management to security and penetration testing?

's answer has excellent suggestions. Does your current company have a security testing/penetration testing group? If so, I would recommend that you sit down with some of your colleagues in that group and ask them this same question. In my experience, the people who actually do this work are enthusiastic about sharing their knowledge and their understanding. I used to subscribe to mailing lists on penetration testing (back in the days when people actually used mailing lists) and I learned a great deal about the craft (enough to decide that I wasn't well-suited for it!) from those who actually did it. One other thing that you can do is to learn to think like an attacker - i.e. if I wanted to use this Web site/application to break through a system's defenses, how might I be able to do it? Many types of hacker exploits are described on the Web, and you can learn about them pretty easily. Once you learn about some of them, apply your critical thinking skills that you developed while doing functional tests to devise ways that you might be able to employ some of these techniques to your own applications. (I found a very simple back door into an online education Web site by doing exactly this.)

Since you already have a background in test, why not leverage that to help with the transition? Propose a new security testing program at the company you work for. Use business justification mentioned in your question to build interest. Once you have management buy-in, develop a comprehensive plan, perform some threat modeling and do a penetration test. These skills are all key to move into the field of computer security and your background as a successful functional tester will lend credibility to your proposal. Once you have completed this exercise you will have some good stuff to put on your resume and talk about during an interview.