It is my opinion that IT auditors are the most clueless and useless people on the face of the earth.
That being said, if it is what you want to do then have at it. There is nothing exciting about it at all, just tons of "I haven't got a clue about network security so I'll write a big embarassing controls document and have the customer laugh at me to my face"
Edit - what does an IT auditor do?
They gather information on controls/procedures/policies. Then they look up what those terms actually mean, then they make ridiculous recommendations all in the name of the all holy SOX. It is a self made market, and they are doing quite well.