My $.02 - write/find/research security exploits and other bugs in your free time. If something feels too low level, try similar AppSec work in the stacks you're

My $.02 - write/find/research security exploits and other bugs in your free time. If something feels too low level, try similar AppSec work in the stacks you're already "stuck" in (think: Java app logic errors, monitoring specifically for security, SQL injection, etc). Just find something to break and/or defend and do it. Note that defense is complex and each application deployed has plenty of edge cases to consider. I'm kinda in your boat and I've been meaning to make this pivot myself for quite some time and know others who started out doing this long ago. So I can't really give the best advise about how to get hired in that industry -- I just know it's very possible.