> if you're not ready to write extensive reports.. it's probably 75% of the job
Do you happen to have a system for building these out? As a techie, I imagine you've tried something like text-expander or similar... but I see a lot of people unsatisfied that they end up building their own tools.
So all in, there are different tools needed for each report. Fortunately the way we capture the data and notes through out the "op" makes it much easier for the team to put together each part.
There's ways we could automate more, we've even messed with AI writing some of the suggestions and actions based on input. So far though, we still need the humans in the loop.
Honestly the first few reports are hardest, after that you find a process and it becomes much easier.
I've seen a lot of professions where in depth reporting still requires humans in the loop, and I think that will always be the case.
There's a small hope I have that one day writing will be a bit more like programming -- as in selecting a 'class' for a structure of a section / paragraph / thesis you want to communicate, which then provides typed functions for potential inputs -> outputs, freeing up human brain cycles for more interesting ideas.
With that, there are tons of specific disciplines you can focus on for pentesting. I'd figure out what excites you and then go for it. Web app is diff than physical exploitation of security systems etc. but some of them cross over.
Another option. Work for the government, join a red team or apply. They'll train you and you'll leave with a new perspective and possibly knowledge you can't get elsewhere.