It’d depend on their interest, the company & team they’re working in and what specialisations are in place. I’d vote for continually practicing - joining forums, volunteering for aiding developers wanting products tested, joining conferences & online tutorials & see how others deep dive into their testing - just getting more & more experience in testing as a whole and building up the knowledge. 

Specialisations like security, performance etc. can be ideal if the individual wants to develop a career in that field, but the general testing mindset & knowledge of different techniques would serve the person far greater in my opinion.