Why this matters beyond the homelab: This is the payoff post of the entire arc: layoff, lab, portfolio, hire. If you are building infrastructure skills at home and wondering whether they transfer, this is the field report.
The Setup
In March I was laid off from an esports company where I was the sole IT owner for North America. In May I started as a Systems Administrator at a managed services provider in downtown Los Angeles. The sixty days in between were the lab, the blog, the portfolio, and a job search run like a project. This post is the first status report from the other side.
The MSP model, for anyone who has not lived it: instead of one environment you own deeply, you touch many environments you must learn quickly. Multiple clients, multiple tenants, multiple firewall vendors, multiple opinions encoded by administrators who left years ago. It is the highest-repetition training environment in IT.
What Transferred Directly
Identity work, almost one-to-one. Daily provisioning across Active Directory, Entra ID, and Google Workspace is the same discipline as the hybrid identity lab I built for interview prep: forest, domain controller, Entra Connect password hash sync. The lab version had one tenant and zero users complaining. The production version has real joiners, leavers, and lockouts. The mental model is identical.
The diagnostic method. The lab taught a habit the ticket queue rewards: read the actual log before forming the theory. SonicWall diagnostics, RMM alert triage, endpoint weirdness under ThreatLocker and JumpCloud MDM. Different consoles, same epistemics.
Documentation reflexes. An MSP runs on its documentation platform the way the Alliance Fleet runs on its Codex. Walking in already believing that undocumented work is unfinished work turned out to be a cultural head start, not just a technical one.
The Investigation That Proved the Thesis
Two months in, a client began experiencing company-wide account lockouts. Users locked out faster than the helpdesk could unlock them.
The trail started with Windows Event ID 4740 (account lockout) on the domain controllers, and the caller computer data pointed away from user devices toward something programmatic. Correlating from there led to unauthorized Azure CLI activity originating from a foreign IP address: automated authentication attempts hammering accounts and tripping the lockout threshold across the org.
Here is the point of telling that story: nothing in my previous helpdesk-tier roles would have prepared me to run that investigation. The homelab did. A year of building a SIEM, writing detection rules, reading authentication logs for fun, and documenting incident postmortems on this blog meant that when a real identity attack showed up, the workflow was familiar even though the stakes were not. The portfolio thesis was always that lab-built skills are real skills. This was the test, and it held.
What the Homelab Did Not Predict
Honesty section. The lab did not prepare me for the pace of context switching: six clients before lunch, each with different conventions, tooling, and history. It did not prepare me for the human layer, where the technically correct fix is sometimes the wrong answer for the client relationship. And running my own stack made me opinionated in ways I have had to consciously set aside, because “how I built it at home” is not an argument in someone else’s production environment.
These are not gaps a lab can close. They are gaps only reps can close, which is exactly why the MSP was the right move.
The Trajectory From Here
The certification path: AZ-104 in progress, SC-300 behind it, with the endpoint administration cert as the likely third given the MDM work in front of me daily. The identity focus is deliberate. Every week at an MSP confirms that identity is where security, cloud, and operations converge, and the long-term target has not moved: cloud and IAM engineering.
The lab continues, because it has a different job now. Before, it was proof I could do work nobody had hired me to do. Now it is the place I get to build the version of things I only get to operate at work. Both roles matter.
Key Takeaways
- Lab-built identity and security skills transfer to production identity and security work. Not approximately. Directly.
- The MSP environment converts breadth into experience faster than any single-company role I have held.
- The gaps a homelab cannot close (pace, people, humility about your own defaults) are the ones a job closes.
- Sixty days in: the layoff was the reset, the lab was the bridge, and the bridge held weight.