I hate to say it runs like this but it sort of does.

They need to be in the same groups and clubs as the people working or hiring at the companies they want to work for.

While they may eventually get something with just a resume, referrals from local infosec groups, meetups, and clubs is extremely helpful.

Also, at least in infosec, I haven't seen FAANG companies all that interested in hiring remote work at the moment. In fact, those remote seem to be disproportionately targeted in these rounds of layoffs. I've had more remote or hybrid job offers from smaller infosec companies. Just take care if they are looking at a private company without a predetermined exit strategy.

In my experience these smaller companies expect you to know their specific product and services prior to interview; particularity in cloud (e.g. containers, docker, apps, etc).

TLDR: There are a solid number of small public (and private) security focused companies with remote work. Getting referred in from people you know is important. Knowing the specific product/tech wins the interview.