The Unconventional Path to InfoSec: From Windows 3.11, Chef & SysAdmin to CISSP

Prologue: Late Starts and Early Days in 1990s Romania

If I have one regret, it's that I didn't set a hyper-focused trajectory for my tech career right from the very beginning. But times were vastly different in Romania back in the 1990s and early 2000s — there was no defined roadmap, no cybersecurity degree, and no thriving ecosystem of online resources.

My journey with computers started way back in 1992, when I saw my first PC and played my first games. By 1994, I was taking my first programming classes in BASIC — only to quickly realize that pure software development wasn't my calling. In 1995, I enrolled in my first formal Windows training, back when Windows 95 hadn't even reached our market yet and everyone was still learning the intricacies of Windows 3.11.

The Detours: Construction, Culinary Passion, and Business Ownership

My trajectory wasn't a straight line inside a server room. There were periods when I stepped away from IT entirely to pursue different careers and build businesses from the ground up:

• Running a Construction Company: Managing physical infrastructure, heavy operations, tight deadlines, and complex logistics taught me real-world project management and operational risk assessment long before I ever read an ISO/NIST framework.
• Launching a Food Business as the Chef: Driven by passion, I opened my own culinary business where I took on the role of head chef. High-pressure environments, strict regulatory compliance, quality control, and immediate accountability were part of the daily routine.

Stepping into entrepreneurship forced me to look at organizations through a completely different lens. When you've owned a business, paid payroll, managed physical safety, and dealt with supply chain disruptions, you stop viewing IT and security as isolated technical bubbles.

You realize that security exists to enable and protect the business, not to block it.

The SysAdmin Era: From Ransomware Waves to Complete Infrastructure Overhauls

Back in 2014, I stepped back into a full-time System Administrator role at an MSP after years of working as an independent contractor. At the time, ransomware was a relatively new threat on the horizon. Like many IT generalists back then, I didn't fully grasp the depth of information security — my main objective was simply keeping systems up, running, and fixing problems as they appeared.

To grow, I moved to a larger enterprise, intentionally picking up harder tasks beyond my job description just to master Windows Server internals and enterprise networking. My effort led to an opportunity with an international company operating across multiple countries. There, alongside my daily SysAdmin responsibilities, I jumped on a security initiative focused on containerized workflows and infrastructure automation. That project forced me to learn tools like Vagrant, VMware, and Chocolatey, giving me my first real taste of automating security operations.

My next career move was joining an oil and gas company as the sole System Administrator in Romania, reporting directly to a single manager. The local infrastructure was a total disaster. Over several grueling months, I tore down and rebuilt everything:

• Restructured the server architecture and reconfigured domain controllers.
• Re-architected core network switches, firewalls, and implemented secure enterprise Wi-Fi.
• Physically re-cabled racks and hardened baseline configurations.

Once the dust settled, everything worked flawlessly. And that's when the unexpected happened: I got completely bored. With the infrastructure stabilized, my day-to-day routine degraded into repetitive operational tasks and troubleshooting niche engineering software. I needed a new challenge.

The Security Shock: Realizing I Knew Nothing

Deciding to pivot into cybersecurity, I picked up my very first study guide for the CompTIA Security+ exam. It was an absolute ordeal.

Despite having years of hands-on experience managing active directories, firewalls, and enterprise servers, reading that book made me feel like I knew nothing about IT. The sheer volume of jargon, vendor-neutral concepts, and security frameworks felt overwhelming.

One of the hardest hurdles wasn't the technical logic, but the acronym collision:

• Terms that meant one thing in the Microsoft ecosystem meant something entirely different in a standard NIST/ISO security context.
• Core concepts I applied daily as a SysAdmin were framed through an entirely different lens — focusing on confidentiality, integrity, and risk management rather than uptime and user convenience.

To bridge the gap between theoretical security and practical execution, I subscribed to Cybrary back when it was an early-stage startup, and later discovered TryHackMe, which finally connected the dots between defensive hardening and offensive tactics through interactive labs.

The Unfair Advantage: Why Practical SysAdmin Experience Beats Theory

When you transition into cybersecurity, you quickly realize that the best security professionals aren't necessarily the ones who memorized every textbook definition — they are the ones who actually know how IT systems operate in the wild.

Having a background as a System Administrator provides an unfair advantage in the InfoSec space:

1. Native Active Directory & Infrastructure Context: You can't secure what you don't understand, and you certainly can't detect an intrusion inside an Active Directory domain if you've never managed Group Policies, domain trusts, or Kerberos tickets in a production environment.
2. Knowing Where Artifacts Live: Spent years troubleshooting enterprise software with zero documentation? You develop an intuition for application behavior. You know exactly where services create log files, where registry keys are modified, and how temp folders populate — invaluable context when doing forensic analysis or incident response.
3. The "Unlearning" Process & User Behavior: As a SysAdmin, your primary mission is availability. In security, the paradigm shifts toward confidentiality and integrity. You have to unlearn the instinct to apply quick bypasses. However, having spent years on the front lines with end users, you possess an intuitive grasp of human behavior — you know how users bypass controls, where they hide credentials, and how social engineering actually plays out in real life.

The Unconventional Certification Path: Skipping to GCFA and Re-Wiring for CISSP

When most people decide to enter cybersecurity, they follow a standard roadmap. I didn't. In fact, my certification journey was completely backward.

Instead of starting with entry-level credentials, my very first serious security certification was GIAC Certified Forensics Analyst (GCFA) — one of the most technical and demanding certifications in Digital Forensics and Incident Response (DFIR). Coming from a SysAdmin background, this trial by fire made sense: I didn't need to read about how operating systems worked in theory; I needed to know how attackers hid inside them. From there, I expanded into GCFE, GPEN, and eventually CompTIA CySA+.

If GCFA was a test of technical depth, the CISSP was a test of mental elasticity.

Preparing for CISSP meant taking everything I had learned as a hands-on technical expert and unlearning it for the exam. CISSP isn't about how to configure a firewall or analyze a memory dump; it's about business risk, governance, frameworks, and budgets.

• As a technician, your instinct is to immediately fix the system yourself.
• As a CISSP candidate, you have to think like a CISO or Manager: What is the financial impact? What does policy dictate? What is the risk appetite of the organization?

Shifting your brain from a technical problem-solver to a strategic risk manager is one of the hardest psychological leaps you can make in IT.

Final Thoughts: Whatever Floats Your Boat

If there is one key takeaway from my transition from SysAdmin to Security Consultant and Auditor, it's that there is no single "correct" playbook.

You don't have to follow the standard career path to make it in InfoSec. Some people start in a SOC, others come from software development, and some of us spent years fixing servers and running non-IT businesses before realizing our true passion lay in security.

Whatever strategy, certification path, or methodology floats your boat to get there — use it. But remember: the journey must be truly experienced. You can't just float through like a duck in the water, reading dumps and memorizing terms. To succeed in cybersecurity, you have to build deep understanding, embrace the struggle, and be willing to completely change the way you think.

A Final Note on AI, Authenticity, and Zero Trust

Every single idea, experience, mistake, and breakthrough in this article belongs to my own personal journey. However, I'll be the first to admit: I am not a professional writer.

That is precisely where AI comes into the picture. Using AI to help structure, polish, and organize my raw thoughts and personal notes allowed me to share this story in a way that is clear, engaging, and structured for the reader. Why not leverage modern tools to elevate your work?

That said, there is one non-negotiable rule in cybersecurity that applies double when working with AI: Do not trust blindly.

The old paradigm of "trust, but verify" is completely obsolete. The only valid framework today — whether in network defense or AI interaction — is Zero Trust.

AI is an exceptional assistant for organizing workflows and refining output, but the substance must be yours. The concepts, the investigation steps, the failures, and the operational insights must stem entirely from your own hands-on experience. AI can help you package the message, but it cannot replace real-world experience, critical thinking, or truth.