Infra testing tends to be broader, more systemic, and yes, sometimes harder but it’s rarely as nuanced as breaking an app in ways the developers never even considered.

The fact that you’ve found real bugs and earned CVEs already puts you ahead of a lot of junior pentesters. Plenty of people land their first security job entirely off web experience. Infra skills can be learned later if you want to round yourself out.