Transitioning out of IT Audit

Typical IT Audit Exit post. Entering my staff 2 year and looking to transition out of IT Audit. Looking to transition into more cyber security work. Currently, I have my security+ and looking to get more certifications. I know certifications alone won’t solve everything, just figured I mention it. I heard trying to transfer internally is a pain, so I am trying to avoid this route. If you have done this before, could you please share your experience. Much appreciated!