You don’t need a bachelor’s degree (BS) but it can help with certain aspects. The main one being that a BS is becoming a requirement to get your resume past HR. Similar to them wanting certain certs before they will talk to you. The best way to get around this is to network. If you can actually speak to the hiring managers and convince them you can do the work, they can bypass some restrictions for you. Or you could work towards a BS. If you’re ok with working for the government and some other strings they may agree to pay for your degree. The bonus here is that you don’t have to worry about finding a job after college. The government will put you to work, and you’ll likely have to get a security clearance. Even if you choose not to stay with the government after you’ve worked your term, you’ll have a couple years and probably a security clearance to bank on. A BS alone can add a lot to your understanding of the subject if you find a college the focuses on the subjects you want. However, it will not give you experience which is the real problem.
I will tell you from having a BS and several certs, that letters after your name only might get you past HR. Hiring managers will test you and if you don’t know your stuff you won’t hired. A BS and/or certs can help you quickly learn subject matter by forcing you to go through focused material enough to get passing grades. That is why I continue to go through them. I prefer focused learning with a deadline to force me through it. This does make the work much easier to do with understanding the theory behind it. But at the end of the day, you need to do the work before you can do the job.
Here are some practical training focused options to get you started. I’m not affiliated with any training organizations, I’m merely adding them for options. If you’re looking for free training I’d start with https://www.corelan.be They’re open source and pretty good. However, you will have to do some research on your own to get through their demos as they don’t completely hold your hand. They also have classes at several cons. They’re around $1000 I think and you’ll have to sign up quickly as these classes fill up fast. I think there are some other open source options as well but I can’t recall them off the top of my head.
Going into paid options https://www.elearnsecurity.com/course/advanced_reverse_engineering_of_software/ is around $1000 depending on their options. I haven’t taken this course but I’m working through others of theirs. They offer more guided learning. Focusing on you trying yourself first but if you can’t get it, they guide you with solutions because they understand that not everyone will learn at the same rate. You mentioned the SANS GREM which I’ve heard good things about. Full price is around $4500 with the exam. However, if you can get a hold of someone who teaches it you might be able to get a discount. Ask about “scholarship seats”. If you can get that it will bump the price to $3400 with the exam. I mention this as an endgame option. Offensive Security has AWE. http://www.offensive-security.com/information-security-training/advanced-windows-exploitation/ I wouldn't look at this for beginning training but when you’re confident in your training this will take you to the next level. Having passed the OSCP I can tell you will learn a ton but it’s more for veterans. Not that a rookie couldn't do it but you'd have a an uphill battle.
I would find some hiring managers that employ malware reversing and/or vulnerability research people. Network with them and ask what they look for. Explain your situation. From the sound of it, you couldn't do the job now. However when you can do the basics and show you have a solid understanding, you're options get better. If you know a manager and you can show him you know your stuff, they might be willing to bypass some of the normal restrictions they have. Getting the first will be tricky and it'll be easier if you know people. Once you get in though, you should be good.