You can also become a Vulnerability Reward Program bounty-hunter as a hobby for a while. If you manage to find some high-profile bugs and blog about it, work will probably also start coming to you.
I'll start blogging as soon as I've got something new and interesting.
I need to show what I can do, I'm currently studying and I feel like I haven't a lot of opportunities to really show off my skills because the level of recquirements is not high enough, that's frustrating sometimes.
I agree that a blog could be a good solution, I also enjoy writing articles even if my English is not the best.
I'll keep you informed if you enjoy receiving news from random internet people.
I'll certainly think about some softwares I'd like to analyze during the next few days and start working on finding bugs/vulnerabilities/things interesting.