can I become a security expert by doing

first you'll have to think about the kind of security you want to get involved in. System-level security, information security, etc.
In the field of information security there is a lot to be found on the internet, even on Techrepublic but personally I do not think you'll find the right stuff to pass a highlevel exam.
Investing in good training is worth the money, but try to select a trainer with a good reputation.

Self Study and the school of hard knocks are the best institutions to graduate from in my opinion.

I will assume that you are interested in InfoSec, and would suggest the ISC2 or SANS paths. I am certified as an SSCP after having been involvedhands-on with servers, firewalls, switches, routers, etc. for the past 10 years, 4 of which have been hardcore InfoSec focused. I am about to write my CISSP exam. Training for the CISSP exam has been two years of reading, proposing policy changes,configuring tech, security project management, a self paced exam simulator and a 3 day course from ISC.

For the simulator, check out www.boson.com.
Read the CISSP study guides at www.cccure.org
Grab the Information Security Management Handbook-4th E. from Amazon. That, my friend, is a START. Please avoid the "CISSP in 24 hours" stuff. It is crap, and there are enough 'paper-certs' out there already.

If your company is Canadian based, you could probably also use a guy like me, who happens to be looking for work! ;)

Do you consider passing security exams as qualifying you as a security "expert"? If so, then yes, self-study will be sufficient. On the other hand, I know a bunch of so-called "security experts" who claim to be hackers and work for the U.S. Military, and I know a handful of 14 year olds who are polishing up their linux/unix and programming skills. Guess who's better at security.

My point? Certs don't mean a thing to anyone who knows what they're doing. They're only useful in the corporate world where idiot management who think they know what security is run the show. If you want to be a "security expert" don't stop at certs.

I was/am in the same situation you are in, and I got my Cisco Security Specialist 1 certification in about 7 months of work with Cisco CBTs/books/and taking the tests. Did it make me a "security expert"? Well, I guess it depends on what you mean by expert. Do I know how to set up a firewall,VPN, or an Intrusion detection device? Some yes, some no. I use a firewall everyday so I have a lot of hands on with the firewall. I can up VPNs, but I don't do it on a day to day basis. We also don't have much in the way of an IDS because the company won't spring the dollars for it. But I would not trade the experience of becoming a "security expert" for anything.

I believe that too many sys/net admin folks concentrate so much on the basic certs and becoming "experts" at what they do, that they tend to underestimate the value of knowing security. I did when I was going after my MCSE and CCNP certs. But VERY fortunately the place where I work now has a PIX firewall, and I had to learn it as part of my job.

Since the PIX firewall wasn't to hard to learn, I got interested in delving deeper into network security and get my CSS1. What an eye opener!! When I really learned what the crackers can do, and how easy it was to do, and how absolutely vunerable unprotected systems are to cyber-cracking, I became a hard-core believer!!

As far as the certs go, what's better the CSS1 or the CISSP? That depends. The CISSP gives you a very broad view of all of the security domains -but IMHO, if I walked up to a CISSP with a firewall, a VPN concentrator, and an IDS and said - secure my network - I'm not sure many CISSP's could do it - a CSS1, on the other hand, would have no problem.

I guess you have to decide what you want, a theoretical background, or technical knowledge.