People sometimes ask me — gently, awkwardly — whether I “regret” the kebab years.

I don’t. And the more I learn about cybersecurity operations, the more I think those three years were closer to the work I’m aiming for than they look on paper.

Here’s what I mean.

Operations is operations

A SOC analyst’s job is to keep things running while bad things happen around them. Alerts fire. Logs explode. A laptop on the network behaves strangely. You have to triage, decide what’s noise, decide what’s real, escalate the right things to the right people, document what you did, and do it all under pressure without breaking.

A branch manager at a busy kebab counter does almost the same thing, just with different inputs.

The grill is overheating. The chip fryer just tripped a breaker. Two staff are sick. There’s a queue of fifteen people, and someone at the front says their order is wrong. You triage. You decide what’s urgent and what can wait. You delegate. You apologize where it’s needed and you push back where it’s not. You document the day. You close out. You go home and do it again tomorrow.

The technical content is wildly different. The rhythm of the work is the same.

Things that carry over

A few specific things I think translate directly:

  • Reading the room when something’s wrong. When the kitchen is “off” — staff frustrated, a regular complaining, an order taking too long — you feel it before you can name it. SOC analysts develop the same feel for a network or an endpoint that’s “off” before any alert fires.
  • Talking to non-experts under pressure. Most of my customers in Poland didn’t speak English fluently, and I didn’t speak Polish. We still had to get the order right. Most users in a SOC ticket also don’t speak the language of security. That’s fine. You meet them where they are.
  • Logging discipline. Every shift ends with a closing checklist: cash count, fridge temps, cleaning log, supplier orders for tomorrow. Skipping it costs you in the morning. SOC work is the same — the analyst who documents poorly creates problems for the next shift.
  • Calm under genuinely loud pressure. When the lunch rush hits and three people walk in at once and the fryer alarm goes off, panicking helps no one. I’ve done eight-hour stretches like that, six days a week, for years. The “stay calm and work the problem” muscle is well-built.

Things that don’t carry over

I want to be honest about this part too.

The kebab years didn’t teach me Wireshark. They didn’t teach me MITRE ATT&CK or how to write a Splunk query. They didn’t sharpen my Python or my command line. Those I have to learn deliberately, and I am.

What the kebab years taught me is how to keep showing up, and how to do real work in real conditions even when conditions aren’t ideal. That’s not a substitute for technical skill. But it’s not nothing, either.

The reframe I’m going to use in interviews

When a hiring manager asks me about the gap, I’m going to say something close to this:

I spent three years running a high-volume retail branch in Poland because I had to. I led a team of four, handled cash and inventory and customer escalations, and I never missed a day. In parallel, I kept studying — first Python, then security. I’m not coming back to tech as a fresh graduate. I’m coming back as someone who’s also been a manager. If you need a junior who can stay calm in production, write things down properly, and run a shift — that’s me.

If a manager doesn’t see the value in that, they’re not the manager I want to work for.

The kebab years weren’t a detour. They were preparation for the kind of analyst I’m going to be.