No doubt Python first. (Most of security assessment tools / Frameworks supports python payloads, Meterpretor*). Though, python as powerful scripting support you can found most of the pen-testers community is using python for writing payloads.
There is no single language technology to master the IT Security field. You must be aware of various languages like C to analyze things.
You must be well aware of Security Frameworks and their implementations to identify flaws.