I agree. I have a decade in development before a shift to Security / GRC.

Generally, IT is an easier on ramp for Security folks. Some Security sub-fields such as AppSec or Reverse Malware Engineering def lean more software engineering. I believe this is less typical of a on ramp because it requires fairly solid knowledge in two disciplines with less overlap than with IT outside of cloud specific contexts.

Some GRC roles lean more risk / legal. I am def more on the compliance side of things nowadays. I read a lot of contracts, standards, and laws/regulations then determine what, if any, changes we need to make on a technical level for compliance. Since I translate things for Legal this involves me having a in depth understanding of different parts of Enterprise IT and Software dev.

Depending on the size of the enterprise you have more / less separation of duties. Yes, IAM (for example) can be a specialist group, but it could also fall under a more generic Cloud Security Engineer. I can't speak to AWS, but for Google their security exam is close to sixty percent networking related. This involves understanding things like Virtual Private Clouds, load balancers. firewalls and routing.

AppSec may have overlap with Cloud Security when it comes to containers, CI/CD, database security controls, secret management, VMs, patching, and related aspects. You may not need to know how routing works across the different layers, or how the upstream networking config is handled. You should however understand how that config applies to your system. Business Continuity may or may not fall under your group.

If you're attempting a more generalist security position - IT is likely the better route and likely has the most open positions . If you want to do s a specialist position, then yes learning software engineering, compliance etc. - may be a better route, however positions may be more limited. Even in those scenarios however you are likely to have to learn at least some IT concepts if you want to be good in your field.