I've been an admin for 20 years (15 years professionally), mostly Unix with a dash of Windows as required. From the beginning, I've tended to play the paranoid admin, mostly because it's practical and instructive, not because I believe hackers from the other side of the globe are targeting my servers. ;-) Security really is a de facto sysadmin requirement, one which can be practiced daily.
You don't specify whether you want to wear the official badge of "Security Specialist" and do things such as pen testing, PCI compliance auditing, incident response (forensics, etc.) or you just want to be an admin with some heavy security creds to help widen your career options and defend high profile systems under your charge.
Of the few peers I know in the "official" category, the CISSP cert was the first they tackled and they went on to land decent jobs because of it (of course, they had 10+ years of hand-on experience, like yourself, to back it up). There are tons of materials online, in addition to official training materials and courses, to asses your grasp of the material.
While the concepts can be learned and applied on any platform, I personally recommend Unix, since you get such low-level access to everything, with the added benefit of being able to access that information easily via remote shell: watching live tcpdump sessions, syslog entries, web server logs, snort dumps, dumping live system memory, to a million other open source tools for peeking and poking at the innards of a running system.
Due to Unix being an ideal platform for learning this kind of stuff, it easily follows that a great way to learn is by throwing yourself to the proverbial wolves. Get yourself an entry-level Linux or FreeBSD VPS, a true virtualized VPS (such as Xen) with all the "hardware" and admin access you'll need to simulate the real deal in a live, exposed internet environment.
Set yourself up with a live, working system. Get a live SMTP server running, and watch the spam bots and scan for malware. Set up a web server and watch the script kiddies try SQL injection attacks in your web and DB logs. Watch your ssh logs for brute force attacks. Set up a common blog engine and have fun fighting off spam bots and attacks. Learn how to deploy various virtualization technologies to partition services from each other. Learn first-hand if ACLs, MAC, and system-level auditing are worth the extra work and hassle over standard system permissions.
Subscribe to the security lists of the OS and software platform you choose. When you get an advisory in your inbox, read up on the attack until you understand how it works. Patch the affected systems, of course. Check your logs for any signs that such an attack was attempted and if one succeeded. Find a security blog or list that is to your liking and keep up with it daily or weekly (whichever applies), picking up the jargon and reading up on what you don't understand.
Use tools to attack and audit your own systems, trying to break your own stuff. This gives you perspective from both sides of the attack. Keep up with cutting edge of the "black hat" mindset by reading papers and presentations from well-established conferences like DEFCON. The archives from the past ten years alone is a treasure trove of information, much still valid.
Granted, I have no certifications, nor do I bill for "security specialist" services. I just make it part of my daily routine to keep up with this stuff to make myself a better admin. Whether or nor the certs are desired or required for your goals is better left to someone who has them. However, I believe that a heavy hands-on approach is the best way to learn this stuff, and I hope some of my suggestions provide some food for thought.
