Cliff Sullivan ⋅ Largo , FL Internal Revenue Service ⋅ 50 years experience

These are great answers. Don't forget about SCORE www.score.org, a FREE resource for you. We have Veterans Quick Launch program.
I always mention www.navoba.com, National Veteran Owned Business Association, I think the membership is $29 and you receive a great magazine, "Vetrepeneur", with contacts and stories about successful veterans.
William (Bill) Wright,(U.S. Army Ret.) who is the V.P. for the Hillsborough,(Tampa) Chapter of SCORE, owns First Intel Group, performing background checks. I'm sure he would respond to you, sales@firstintelgroup.com, 813-436-0547.

Lee Ivy ⋅ Sunnyvale , CA Hewlett Packard ⋅ 37 years experience

I agree in general with Andy's advice that it might be best to start gaining experience by working for a firm that is already in the business. Examples of companies that do vulnerability assessments are Veracode and IOActive, but there are many others. You can definitely make good $$ if you are good at penetration testing.

Andy Lewis ⋅ Denver , CO Hewlett Packard ⋅ 20 years experience

Great idea. My recommendation is for you to partner with or be employed by someone who's doing it now, just so you get a chance to see how the CivDiv works. Alternatively, start it up part-time while you're active so that you can get some mistakes out of the way without compromising your income. Maybe on an I & I tour?
Also, consider partnering and/or becoming the Physical Security SME working with a local/regional Data Security Assessment/Consulting firm. I've participated in many Data Security assessments and for the most part the greatest vulnerability is physical, thus the physical security assessment team has a pretty loud voice at the debrief. Most of them say "if I got a job as your janitor..." but the best was the physical security guy who conned the site security guards into holding the door for him as he carted out some stolen equipment.
Disclaimer: I'm with HP now and the example above did NOT happen at HP :-)
Final word: don't be surprised if all you get back are blank stares following your report. Also, get used to framing incremental solutions - "for $1 mil you've solved 100% of XYZ problem. For $20k you've got it 80% solved, and for $500k you've got it 90% solved." Many organizations recognize that they AREN'T going to lay out the cash to solve 100% of any problem unless it's immediately relevant and there's a chance to make money from it. BUT, they also know that if they do NOTHING then there can be significant legal liability. So, if you're the guy who can show them a range of options from "check the box" all the way to "problem solved" you're likely to get more business in the real world where people are making compromises to balance risk and costs every day...
Good Luck!