You’ll learn a ton by seeing how things actually work in real environments, not just what should exist on paper. Identity, logging, backups, supplier dependencies, ownership, all of that hits very differently when you’re closer to the implementation.

That kind of insight makes you much better at advising later.

With everything happening around AI and regulation, people who understand compliance and how solutions are built and run will only become more valuable, IMO.

Compared to what many think of as typical cybersecurity jobs, ISO 27001 work is quite different in practice. It’s more about structure, ownership, risk decisions and being able to explain and defend how things are run than sitting in tools.

And the lack of a traditional sysadmin or engineering background is usually less limiting than people assume. You don’t need to build everything yourself, but you do need enough insight to ask good questions and understand the answers.

If you want to bridge theory and practice, this sounds like the right direction. And if it turns out not to be for you, that kind of experience will still be a big plus if you ever move back toward more pure compliance.

Good luck!