Computer Associates, Symantec, Microsoft, MITRE, RSA Security, Network Intelligence, ESET, Veracode, Rapid7, Sourcefire and there are many more companies than I could think of that are concerned with this field.
I worked for a pretty well-known security company and interviewed for an experimental security developer position at a government-funded research organization (but chose instead to do military software instead).
When I first started, I really didn't know anything. I had my degree in CS and started in a security company, where I learned all the stuff like XSS, XSRFs, vulnerabilities, secure programming, some exploitation stuff like code injection, stack smashing, etc.
What knowledge companies might expect you to bring to the table really depends. An understanding of networking and networking protocols is important if you want to work in stuff like exploiting systems or network intrusion. Knowledge of vulnerabilities and threat vectors is good. It's really a pretty broad field, as then you can get into stuff like behavioral analysis and heuristics to determine if someone is really attempting to break into a system.
For example, take a look at a job posting on Rapid7 (they bought Metasploit): http://www.rapid7.com/careers/metasploit-exploit-eng.jsp
Here's one from Veracode: http://www.veracode.com/careers/index.html
When I worked in the security industry, I was one of the only big Linux/Unix experts in the company (out of hundreds of devs and QA). But having experience with Unix-y systems would be good as well. You want exposure to different platforms.