It depends on what you actually want to do. Pentesting is very different to DevSecOps. So it's hard to give advice.

Also, the security engineering field tends to require more practical experience first - eg software engineer, or IT helpdesk.