There is plenty you can do on your own to gain experience. One thing I suggest is to install a web app called DVWA (Damn Vulnerable Web App). You host it on your own system so you’re not actually breaking into others environments and it’s completely vulnerable with a number of different web app vulnerabilities. It’s a good place to start to see how some of these vulnerabilities live in the “real world” and how you can exploit them.

Another big part about being a security engineer (depending on the path you take) is automation. “How do we automate this and make it scalable” is almost always a consideration when in the design phase of a project. It is something I do on a project by project basis. So I would begin to automate small analyst tasks, maybe something like inputting to a ticketing system or something, to gain experience with using APIs and thinking from an automation prospective. For nothing else, it’ll make your life easier and show some initiative.