From QA Engineer to Blockchain Security Auditor — Which Skills Help Most?

I am asking for my student. He is working as a blockchain QA engineer for almost two years, mostly testing Solidity smart contracts for DeFi projects. Lately, he is thinking about moving toward security auditing. He already understand CEI checks, access control, and gas optimization, but unsure where to focus next.

Some people suggest learning EVM opcodes, while others say he should start reading real audit reports. For those who’ve already made this shift, what practical steps helped you grow from QA testing into blockchain auditing? What I should advice him