[1] You should start to "explore" different domains within Cybersecurity, for instance in offensive side - red teaming, penetration testing, exploit development, and so on

Red teaming - you're against people, and processes, stealth, data exfiltration, lateral movement and

https://twitter.com/Edirined/status/1459780216729980930

remaining undetected as long as possible is your attribute, your goals are almost same as what you do in penetration testing.

Now, penetration testing - you're against the technology stacks in place, that accounts to - web apps, mobile apps, various softwares, APIs