What’s after Vulnerability Management?

I want to go toward the offensive side of security, but what would be the next step?
I’ve about 2/3 years in defensive security/vuln management and patching. Ideally I’d like to be a pen tester, or at least continue in a remote position

continue cybersecurity defensive defensive security management offensive patching pen security vuln vulnerability vulnerability management