In my experience a huge proportion of security roles are filled with checklist cowboys/girls. The cadre of people you're thinking of is a small part of the set.
This is my experience as well, a lot of pen testers seem to be possessed of an overblown sense of self-importance because they possess the capability to install the Debian distro kali, can run the aircrack suite, and know how to use wireshark. Wowsers.
