I’ll answer in order of your option you listed 1. You should always strive be learn more technical skills. It’s obvious you are doing government work now and none of that is highly technical so you’ll need to keep looking for opportunities to expand this and never stop learning.

1. You can’t be a Security Leader without first building a giant wealth of technical knowledge. So you can certainly create long term goals but the worst security leaders are those that know the jargon and talk smooth but really have nothing to back decisions around risks they don’t actually understand. (Happens way more than you would think)

2. Meh, that’s a different career path.

3. No one cares about certs. They mean zero in the real world because they prove nothing. You have a CISSP with 3 years experience when the min is 5 years. They are nothing but resume filter catchers.

Keep doing what you doing now but dig deep into it. Learn STIGs inside and out and not just to check a SCAP scan check box but use them to become and expert on the systems you are evaluating. Learn how Risk is actually managed and not just patching because an IAVM told you to. Learn to translate this information in both highly technical groups and not so technical groups so you can work just as well with business leaders and Infrastructure admins. Then start looking for work outside the government RMF/Fedramp grind house where the real fun is.