Some dates weigh more than others. Last June 30, I received my completion certificate for Jedha's Cyber Full Stack bootcamp. A few months of intense immersion in cybersecurity, a discipline I chose to embrace after thirty years of operational life in a completely different field.
This post isn't a tutorial. It's a checkpoint — the kind of pause you allow yourself between two summits, once you've set the pack down and you're looking both at the path already walked and the one still to climb. And there's still ground to cover: on July 6, I start a new cycle, Cyber Lead, running through October 16.
Going back to school at 55
Let me put it plainly: deepening cybersecurity expertise at fifty-five isn't the most common path. People more readily picture the fresh junior graduate, raised on a terminal since their teens. I arrive with something else: three decades of operational experience, a culture of rigor, compliance, and risk management that you don't pick up in a few weeks.
For a long time, I thought age would be a handicap. I eventually understood it could be a differentiator. Cybersecurity isn't just about commands and exploits; it's above all a matter of method, composure, and judgment. A security incident is a crisis to manage — and managing crises, that I've known how to do for a long time.
The bootcamp gave me the technical grounding I lacked: the vocabulary, the tools, the reflexes. But above all it confirmed a hunch — my earlier career isn't dead weight to drag along, it's a foundation to build on.
What Cyber Full Stack actually taught me
Over a few months, the program walked me through the essentials of the analyst's trade. I won't run through the whole catalogue, but a few milestones left a lasting mark.
SIEM first, with a full Wazuh deployment — manager, agents, detection rules, threat hunting. That's where I understood the difference between seeing logs and understanding what they're telling you. Detection isn't passive reading: it's investigation.
Then memory forensics, with Volatility. Reconstructing what a machine went through from a simple RAM dump has something fascinating about it, almost archaeological. You dig, you cross-reference, you piece together a story from fragments.
Network analysis and packet-capture reading, to track down an exfiltration hidden inside a DNS tunnel. Structured incident response, with proven methodologies like PICERL, and mapping adversary techniques via MITRE ATT&CK. Finally, the compliance and governance side, building organizational profiles aligned with frameworks like the NIST CSF.
What stays with me is how coherent it all is. You don't become an analyst by stacking up tools; you become one by learning to connect the technical to the organizational, the alert to the risk, the detail to the big picture.
Learning by building
One conviction grew stronger over these months: you only truly learn by getting your hands into it. Guided exercises are good. A lab of your own, that you can break and fix, is better.
So I set up my own infrastructure: a dedicated server to host disposable environments, where I can deploy, test, tear down, and rebuild without consequence. It's in these sandboxes that I progressed the most — far more than by dutifully following course material.
In fact, on the very day I'm writing these lines, I'd just spent several hours fixing a stubborn Wazuh install and cleanly deploying a threat-watch dashboard over HTTPS. None of that was on the syllabus. That's exactly the kind of real work, with its dead ends and its satisfactions, that builds the kind of experience no certification hands you on its own.
For anyone following a training program who might be reading this: training gives you the map, not the terrain. You have to go walk the terrain yourself, even if that means getting a little lost along the way.
The next summit: Cyber Lead
So what now? Rest, just a few days' worth, before setting off again. On July 6, I start the Cyber Lead cycle, running through October 16.
If Cyber Full Stack trained me to analyze, this new cycle aims higher: the posture of leadership, the big-picture view, the ability to steer a security strategy rather than just execute it. It's a natural extension of my profile — that of a professional who, backed by operational experience, isn't content being just a technical link in the chain but aspires to carry broader responsibility.
I won't pretend to know exactly where all this will lead. Continuing to learn is a bet, and honesty requires admitting you're moving partly in the dark. But I know one thing: every cycle completed closes a door of uncertainty and opens one of possibility.
What I take away, for now
To anyone hesitating about returning to training, whatever their age, I'd say this: doubt is normal, and it never fully goes away. You simply learn to move forward with it.
Cybersecurity needs varied profiles. It needs brilliant young technicians, of course. But it also needs people who have watched organizations function, fail, and pick themselves back up; who know the weight of a decision and the cost of negligence. That's the value I intend to bring.
The cycle closes. Another begins. And honestly, I've never been this curious about what comes next.
This article is part of the site's cybersecurity coverage. Technical analysis drawn from real projects is published regularly.