I would recommend reading as much as possible.  When I was first getting into security I found a lot of material available on the web, but the best was getting a good grounding in TCP/IP through books like the CCNA book, then building up through Hacking Exposed and then on to Web App hacking books.  Setting up a small lab at home was my next step.  Of course now there are also a lot of good videos that illustrate pen test techniques.

Having researched a lot of options I decided to take the CAST course because I wanted to prep for the CREST application tester exam and it is a hands on course aligned with CREST.

Having gained the CSTA and CSTP certs with 7Safe previously (I am in the UK), I found the CAST exam to be a major step up in terms of the learning level.  It is designed to make you think, and our instructor was an experienced pen tester. The exam was a series of challenges - and in the end about 30% of us managed a pass.

I understand this is being offered in the US as well, what with CREST becoming an international standard. 

http://www.7safe.com/application_security_training_course.htm