How to correctly and productively retrain from IS to InfoSec?

Question

reverse engineering

Good day,

The question is a little broad, so I'll try to simplify in the style of the problem.

Given:
Education = Master of Information Systems
Position = Information Security Engineer
Work = Complex Banking Security (Kaspersky, Qradar, PaloAlto etc.)

Objective: Go to a deeper system level, write exploits, hack, test applications, etc.

Additional information:
Unfortunately, there are many different directions from Penetration Testing to Reverse Engineering. And since I am not mature enough to objectively assess the possibilities of all these profiles, I am trying to assess what exactly is worth studying and in what order. At least to the level where you can clearly distinguish black from white.

We are talking about a strong fundamental base.
(It's clear that when working with a certain platform, you need to know its structure. YaP, etc.)

The question is complex, I will be glad to any productive comment and criticism.

Thank you for attention.