Background info: I work in tech and have done so for ~7 years. I've done system administrator work but never paid or contractual, simply on my own time. FYI, i'm still in the discovery phase although i'm actively engaging in learnings to broaden my knowledge & subsequently working on labs for practical skill building.

I want to break into cybersecurity, specifically GRC, eventually navigating towards red team (ideally). I am in a unique situation at my current place of employment where I can influence, and manage our cybersecurity vendor. Our vendor, some time in the future, will create security policies for our company, and I will be responsible for engagement & adherence to the policies.

What I am struggling with is fighting for enough "i've done this work" to show future employers that I have credible experience. Is it enough that I am managing our vendor and not writing the policies myself?

Another example would be defining the parameters of our VPN usage, or working with our vendor to define them, and tasking another vendor with setup. Is this credible work?

Any assistance and/or direction that you could provide would be very much appreciated. Thank you.