I'm fairly good at crypto (not as good as Colin of course) but I think that's not of that much help in general security stuff. Pen testing = knowing all the bugs and code smells in the popular Javascript frameworks, 0 days in a zillion libraries like log4j, etc. I'm basically resigned that the modern web is bloaty buggy crap and so I haven't found it worthwhile to get too familiar with its workings. I have gotten some fairly pure crypto gigs here and there, but I think wider security, especially web security, is a much bigger and messier subject.