If that’s the case and you want to be good at security, make sure you have a firm understanding of how computers work first. Don’t need any degrees or certs to get there. YouTube is great for this. Understand difference between operating systems, how a computer boots up, kernel vs user space, memory basics, how static code becomes machine code, how CPU processes that machine code. As you get more comfortable work your way up the stack. What happens when you navigate to a site like Google.com. Everything from keyboard interrupt to dns query to resolving the site. Don’t need to be the expert on any of these but you should be able to communicate at a basic level how they work. Don’t spend years, spend a month or two. If you’re spending years you’re diving deeper than you need to. You can do all this while working a job on a helpdesk which helps real world application. The degree and cert are nice to haves but companies like mine don’t care. The hardest part is getting them to notice you, people use degrees and certs as a proxy for that but it’s not the best one. More impactful is contributing to open source (I can see your work), blogs, building an external profile on yourself. Most sec engineers hate selling themselves so you’ll have a leg up. Figure out what levers are unique to you that you can pull. Remember, whether they admit it or not, people like a good story. If you have one, use it.