Our infrastructure is built entirely on AWS and we went through the HIPAA process to ensure that our system is HIPAA-compliant. Where should we look or what next steps can we take to obtain other certifications (e.g. ISO 27001, SOC 1/2/3)?
In order to be HIPAA compliant, you should have verified a substantial amount of your configuration is properly secured, otherwise you or your client will be subject to the financial penalties which come with HIPAA.
My suggestion would be to go back to whoever handled your HIPAA compliance testing and ask which certifications you are closest to, and proceed that way. Then you can look at the business need for other certifications.
The answer to this question is extremely broad. Risk & Compliance represents an important field within Cybersecurity, similar to application security or secure networking, so you probably need someone with a specialty in this (is my guess).
Also, before doing anything you're going to want to figure out which compliance framework to pursue. Each one is different, and the most valuable one depends a lot on the nature of your business. A Risk & Compliance manager or consultant may be able to help with this.