Some thoughts (in no particular order):

(1). It's considered un-cool to recommend certifications here on HN, but in my experience they can help. I believe the problem comes from a combination of a. people who believe certifications alone are a panacea, and b. people who work hard on getting the certifications at any cost (including possibly outright cheating) and don't actually use the certification prep process as a real learning opportunity. I expect there is significant overlap between groups (a) and (b) but that's just a hunch.

Anyway... consider one or more of the "starter" level security oriented certifications as part of the overall story you want to tell with your resume. Security+ maybe.

(2). Compete in CTF events and such-like.

(3). Participate in bug-bounty programs. Do security research on your own time, get your name "out there" for producing actual results.

(4). If you're a developer now, think in terms of working on automation / tools related to security (offensive or defensive tools). Start a new open source project from scratch, or find a way to get involved with an existing project. Search for interesting projects on Github to possibly work on

https://github.com/topics/infosec

https://github.com/topics/hacking

https://github.com/topics/security

...

(5). Attend local security/infosec related meetups. Learn a lot about some specific topic and then volunteer to do a presentation on that topic at one of the Meetups. Heck, maybe present on the cool new tool you wrote as part of (4) above. Note: most Meetups are always on the lookout for presenters, and this is one of the easiest ways to start making a name for yourself in a given field.

(6). Blog about security related topics, including security research that you do. See (3) above.

(7). Used LinkedIn. Share security focused content there. Network with people in the field that you meet (see (5) above).

(8). Tweet about security. Build an audience of people who know you and your knowledge.

(9). Set up a "home lab" (in the literal sense, or use cloud servers, or a combination of both, whatever) and start learning. Even if it's not something you can document as a "bullet point" on your resume, you still need the raw underlying knowledge to support several of the previous points.

(10). Attend the big national hacking/security conferences - Defcon, BlackHat, RSA, HOPE, Schmoocon, whatever. Network and get to know people in the industry. Drop the word here and there that you're looking for work if it seems appropriate.

Not to say you need to (or should) do all ten of those things, or even any one specific one of them in isolation. But I think some combination of the above could contribute to helping you achieve your goal.

And to collapse a lot of those threads down to one (11) point, I'd say "learn, study, study, research, learn, learn, learn, study" as much as you can. At the end of the day, if you know your shit, and I mean really know your shit, not just the "can pass a certification test" level, but the "I could have written the damn test myself" level, or the "developed a new exploit myself that is big enough to get a talk accepted at Defcon", it will show over time.

Edit:

Just to add another thought or two. If you're particularly interested in crypto (as in "encrypting data", not "cryptocurrency") then consider the Cryptopals Challenge(s).

https://cryptopals.com/

Also, HN user tptacek is a well known figure in the infosec field, and often chimes in on career related threads from what I've seen. You might browse through his comment history and see if he's dropped some useful advise. I'd almost be willing to bet money that he has.

https://news.ycombinator.com/threads?id=tptacek