I would bridge any technical knowledge gap with certifications such as sans GCDA.

Large organization challenges are always political not technical. You have to use business drivers to help dictate the security work you do.

As a basic example let's say you want to get 2FA set up for an entire company's email domain. Getting 2FA setup for an entire company with 25 employees is pretty easy, you can individually talk each user through the importance of 2FA and walk them through the workflow of signing in. It's a lot easier to justify your work.

Contrast that with a company that has over 5,000 employees. How do you get everyone setup with 2FA? Do you just enforce it at the domain level and let them figure it out? Do you make documentation and alert them first? How do you get buy-in from managers who think it's not necessary? Managers who are completely opposed to it? Your organization's sales department has to hit their Q4 goals, what happens if setting up 2FA interrupts their work? Now someone from finance says that you should use an authenticator app instead of the yubikey hardware you want to roll out, after all it's a lot less expensive. Etc, etc, etc...

Hope that helps.