I started reading SOC alerts for a living. I now build and ship products. People assume the security years were a detour. They were the opposite — they're the reason the things I build tend to survive contact with reality.

What the SOC brain installs

After enough incident reviews you stop asking "will this work?" and start asking "how will this fail, and who benefits?" That reflex shows up everywhere: in the way I model auth, in what I log, in the inputs I distrust by default. It's not paranoia. It's having watched the optimistic version get owned.

The unlearning

The hard part of leaving security was learning to ship before everything is perfect. A SOC rewards caution; a startup punishes it. I had to learn that an audit roadmap is worthless if the product never launches to need one — and that "good enough, with a plan to harden" is a legitimate engineering answer.

What carried over

Threat-modelling a feature in ten minutes. Knowing which corners are safe to cut and which ones end up in a breach notification. And a healthy respect for the boring controls — backups, least privilege, patching — that no one thanks you for until the day they save everything.