I would like to challenge the conventional approach and suggest starting with reverse engineering, particularly malware reverse engineering, as a foundation before engaging in research. Engaging in activities such as participating in CTFs, hacking boxes, and reproducing CVEs is valuable, but without the fundamental knowledge, it is akin to attempting to run before learning to walk.
I recommend exploring OpenSecurity's courses to gain a comprehensive understanding of topics such as assembly, debuggers, and x86 architecture. It is essential to have a solid grasp of these concepts before diving into malware analysis.
Then, I suggest watching OALab's YouTube channel and streams for excellent malware analysis content, and practicing by following along with his videos, reversing malware with Ghidra (if you do not have access to an IDAPro license). Additionally, if you have the money for it, also participate in virtual machine-based malware analysis exercises, such as those offered by the SANS Institute, to gain hands-on experience.
Once you are confident with the material from these resources, you can choose to specialize in a specific area that interests you. Would you like to delve into Linux Kernel security, Windows internals? Perhaps mobile security or ARM? By having a strong foundation, the research papers, CVEs, and exploits will be easier to comprehend and analyze.
Don't get discouraged by setbacks, it's a difficult field, just always strive to expand your knowledge and skills.