I've been in cybersecurity five years, and they feel like ten

The skills that actually let you lead in cybersecurity appear on no syllabus. Nobody certifies them. And in my case I learned them well before I knew what a DLP was: behind the bar of my family's business, at fourteen.

I've been in this profession five years. But they've felt like ten. I don't say that as a complaint or as a boast: it's simply what happens when you arrive at a trade having already learned the part nobody examines you on.

Because my first job wasn't my first job.

Fourteen years old, a family business and no heroics

At fourteen I was already helping out in my family's business. At home, working was never told as a feat or as a life lesson: it was what had to be done. A necessity, not a choice. There was no speech around it.

Seen from outside it sounds like a story of overcoming the odds. Lived from inside it was far simpler and a good deal less pretty: Saturdays that weren't Saturdays, summers that started behind a bar, and the early sense that things don't hold themselves up.

It has taken me years to understand that all that — which at the time felt like nothing but tiredness — was the best training I've ever had.

You take a lot behind a bar

And I don't mean the hours on your feet.

Behind a bar you take rude replies from people who've had a bad day and decided you're the one who'll get it. They criticise you to your face knowing you can't answer back, because you're fourteen and because the customer, at that moment, is right even when they're not. You learn to swallow it, not to say the first thing that comes into your head, and to carry on serving the next person as if nothing had happened.

You also learn something less obvious: that almost nobody is attacking you. That behind a bad manner there is almost always something else — a rush, exhaustion, a problem that has nothing to do with you — and that if you manage not to take it personally, the conversation changes completely.

That is, without exaggeration, the same skill I use today when a client walks into a meeting angry, or when someone on a team snaps over something that wasn't the real problem.

Talking to the board when the board is your father

There's another part you learn early in a family business that is worth its weight in gold later: talking to whoever is in charge in the middle of a crisis.

In your family's business, the board is your father. You learn to keep the professional separate from the personal — or you try to. There's no other way.

I just wanted to play LoL

Best not to dress this up.

I was a kid who wanted to play LoL, to tinker with the computer until it broke (and then try to fix it, which is where everything else started) and to play football. I didn't want to learn resilience or customer handling. I wanted to be left alone on a Saturday.

It was a big change. And sorting out your priorities that early carried a price I wasn't able to measure at the time.

It's also true that the same kid who broke things on the computer ended up doing this for a living. So something of all that stayed with me along the way, and it wasn't the worst part.

"You're very mature for your age"

I've been hearing that line since I was small. For years I took it as a compliment.

Now I see it clearly: it wasn't maturity, it was that I'd had to grow up. Not the same thing. Responsibility that arrives early and isn't optional installs reflexes in you that later look like character: knowing how to carry yourself, holding pressure without dramatising it, asking instead of assuming, understanding that nobody is interested in your excuses — only in what you're going to do now.

Incidentally, nobody has said it to me for a while. I've got grey hairs now and the line has stopped being funny.

What actually lets you lead in cybersecurity

All of the above, added to the technical side, is what has made it possible for me in five years to run projects, coordinate teams and, most recently, rebuild an information security function from almost nothing into a team of more than ten professionals.

I'm not telling you this to pin a medal on myself. I'm telling you because, when it comes to explaining how you get there, nearly everyone looks at the certifications. And the honest answer lies much further back.

What I have is a lot of hours listening. A lot of hours solving things while listening to dramas that weren't mine, at the bar and later in meeting rooms. Learning to tell what someone says from what's actually going on with them.

The acronyms will come when they come: you study them, you pay for them and you pass them. Whenever they like, I'll get certified. The other thing doesn't come out of an exam.

It's explaining a risk to someone who has no reason to understand it. It's giving bad news in good time instead of late. It's someone on your team daring to tell you you've got it wrong. It's holding your nerve on the day everything falls over, because people look at whoever is leading before they look at the console.

It's also, incidentally, why I ended up co-founding USOARIT: because the bottleneck for most technical companies isn't the technology, it's the teams and the processes.

Precisely what AI isn't going to take from you

We're at a point where a good part of the technical work is being automated at a speed that a few years ago looked like science fiction. I use AI every day and it makes me a better professional.

But there's one area where, as things stand, it doesn't compete: trust.

Nobody delegates the difficult conversation with a board to a machine. Nobody asks a model to hold up a team's morale through a bad week, to notice that someone has been burnt out for months, or to decide what a client gets told when the news is bad. Reading people, building trust and taking responsibility remain deeply human.

What you learn behind a bar at fourteen has become, oddly enough, one of the hardest things to replace.

The five things that have served me most (and none of them is technical)

If you're starting out and wondering what to work on besides the syllabus, this is what has moved the needle for me:

1. Translate. Explain a technical risk in the language of whoever decides the budget. If the board doesn't understand what you're saying, the problem is yours, not theirs.
2. Give bad news early. An incident reported in time is a manageable incident. Reported late it's an incident plus a crisis of trust.
3. Listen properly. Tell what someone says from what's actually going on with them. Almost no team conflict is about what it appears to be about.
4. Don't take it personally. Behind almost every bad manner there's a rush, fear or exhaustion. Whoever doesn't take it to heart solves twice as much.
5. Hold your nerve. On the day everything falls over, people look at whoever is leading before they look at the console. That one gesture is worth more than any runbook.

None of the five is learned by reading. All five are learned with another person in front of you.

What it has cost

I don't want to sell this as a clean story either, because it isn't one.

Getting here has cost me hours. A lot of them. Hours I didn't spend with my family. Plans I didn't make. Hobbies that stayed on pause far too long. Ambition and commitment to work come with a bill, and it isn't always paid by one person alone: the people close to you pay it too.

I've learned — late — that holding out for more hours isn't a virtue, and that the part of me that has contributed most at work didn't come from the long nights, but from the people in front of me. Today I choose differently: I'm just as demanding, but I've stopped confusing intensity with commitment. Precisely because all of it has brought me to a life that fills me up and lets me enjoy the small things.

Thank you

I'm proud of what I've built. And I'm fairly clear about where it came from.

It came from a family that taught me, without ever sitting me down to explain it, that work is to be respected, that people are served well even when they turn up in a bad mood, and that things get done. There was no talk about values. There was example, which works rather better.

So thank you. Genuinely.

And if someone is starting out and has had to grow up before their time, know that it isn't a rucksack to drag around. Looked at properly, it's half the trade.

Toni

This is a courtesy translation of the Spanish original. I help companies with their security strategy and with building and consolidating their teams, and I train the people who are going to lead them. If that's where you are, let's talk.