The way I look at it, people come into technical security either from operations or development backgrounds, but it's hard to distinguish someone who has the required skills from their years in dev or ops from those who have managed to do their core work so without going into the relevant details; their CVs are going to look pretty much the same.
A hobbyist might have practiced on some CTFs or vulnerable machine challenges, but unless they haven't e.g. won some bug bounties or gotten some CVE disclosures, then that won't be really visible on a job application. If certifications aren't considered relevant by security hiring managers, what is?
You wrote a compiler, kernel, emulator, firmware, or boot loader.
You wrote a small demo, such as 4096-byte or 512-byte. Like this: https://en.wikipedia.org/wiki/Demoscene
You have hand-optimized code via assembly language.
You have debugged software with a JTAG device or a digital logic analyser.
The common feature is low-level experience. Somebody should be comfortable with assembly and related things.
It's true that not all security jobs are the same of course, so there will be plenty of places wanting other stuff, but I don't know about those.
The OffSec Penetration Testing with Kali Linux (OSCP certification) is excellent and outstanding and cheap.
https://www.offensive-security.com/information-security-trai...
While the course itself is $800, you'll most assuredly need another 60 days of lab time for the certification. I think all-in-all it cost me $1,500 for everything.
The course material is excellent and wide-ranging and very hands-on. If you have a family, it's a serious investment of time. It put a serious dent into my night time hours for a couple months.
The OCSP certification is widely-respected and not just a "paper certification" like some of the others (c|eh). Lots of practical skills. Great stuff.