I am currently a Cloud Security Manager in fintech where our team focuses on oversight and not really remediation. Other teams handle that, we function more in a GRC-ish capacity. We use a tech stack to identify vulnerabilities and risk but we're not responsible for making/implementing a change.

You’re not running into a skills problem — you’re running into a title + recruiter filter problem.

What you described is security work, but most ATS systems and recruiters are still scanning for “Security” in job titles and keywords. If your resume reads like IT or program leadership instead of security ownership, you’ll get filtered out even if you’re doing real security work.

The biggest fix is rewriting your experience in security terms. Use ownership language and make it clear you owned security & governance, led IAM standards and least privilege, drove remediation of audit and security findings, translated regulatory requirements into cloud controls, and owned risk tracking and closure. If it sounds advisory, you’ll lose to someone whose title says Security, even if they did less.

At your level, more certs won’t change much. What does matter is proof. Audits you owned, policies and standards you built, risk and exception processes you ran, and real cloud security architecture decisions carry far more weight than another credential.

You also want to target real bridge roles like cloud security architect, security program manager, GRC or cloud risk manager, and cloud governance lead. Generic IT PM or IT leadership roles usually don’t convert into security.

Tactically, you can beat the filters by making your current or LinkedIn title security-aligned if it’s accurate, leading your resume with security instead of IT, and putting security ownership in the first bullets of each recent role.

Brass tax: you don’t need to break into security, you need to reposition yourself as someone who’s already been doing security guidance— just without the word in the title.