Exit Path from SAP Security Consultant role

Hello Blind team- One of my friends has been working g as a SAP security consultant with one of the WITCH companies. He is looking for guidance on his next move, SAP security (GRC, S4 Hana etc.) is quite niche and prospects of upward movement has been and will continue to be limited and quite frustrating. We are looking at paths such as Program Management or Solution Architect in the Cloud. Has anyone made this shift and is willing to share their experience? Or for that matter if you have been able to move from SAP security consultant to any other role. Would really appreciate any direction here. Thank you! YOE: 20 TC: 150