Good question and something I am trying to do as well at the moment (web dev last few years so I do know some coding Python/PHP/JS).

My own method has been war gaming sites like pwnable.kr, learning C, getting better at bash, bug bounty programs, playing with security tools (bettercap, sqlmap, metasploit) and eventually I would like to get OSCP certification.

Would love to hear from people experienced in the profession if there is anything I am missing or any pointers they could offer me.