Hopefully I can help, I have experience in both (worked in web dev until I graduated from uni and moved into infosec). Both are pretty interesting, if you enjoy one over the other it's worth pursuing whichever one you find more interesting overall. Honestly I get pretty geeked out over each haha.
Web dev had the advantage of being just you and your team. It's "quieter", you pretty much just get to focus on your work, people don't really bother you (maybe a random feature request or a bug, or a project that needs other departments to cooperate on, or occasionally someone may think because you're in IT you have to fix the printer, but that last one is more for smaller companies that don't really have their own dedicated help desk crew lol). It felt more free to explore and be a bit more creative, although it does carry it's own deadlines and demands like any other IT gig. Downside, depending on the area, it's not always as in high demand as SecOps, so availability and pay may be lower. If you can handle both design and code that does help a lot though.
SecOps is what fascinated me the most personally, but I'll keep my opinion unbiased. It is a bit more competitive, most openings require experience, certifications, training, etc. The demand is pretty high, cybersecurity is one of the higher paying IT paths in general right now as organizations are starting to take things a bit more seriously. It is also fun, it touches on pretty much everything, when it comes to security, anything that touches the network can be a risk, so you get to explore all of that, and there's some pretty cool things you can play around with in the process. That being said, you are no longer just dealing with computers in the process, but people as well. Not necessarily as much as working help desk (been there as well lol), but there is ton of collaboration. You don't get to fix every security problem you identify, which means you need to work with other teams that own those systems instead to get it resolved. So there is pushback. One thing I found out pretty quickly is that most people are not security minded, they just want their work done quick, and so once you expose the risk they created and add more work on their plate in order to lower it, they tend to get a little bitter. Not trying to scare you, just a heads up that it can be a bit of a minefield to navigate. That being said, I wouldn't trade it for any other role imo.
Overall, just go with whatever you like more. Both are great options, both have advantages, try each out and see whichever one perks your interest more.