Map Your Bridge: Cloud, Security Ops or AIOps

Tier: Advanced · Workflow area: Career elevation · ~45 minutes to choose; two quarters to cross

This playbook covers UC-57, UC-58 and UC-59 in one decision framework. All three destinations hire from the desk; all three reward the verification discipline this track drilled; and all three are crossed the same way — one certification spine, one artifact stream, AI as your study accelerator and lab copilot, never your substitute for understanding.

When to use

• pb-50's conversation pointed you at a bridgeambition plus a shrinking L1 pipeline is the classic moment; the desk skills are freshest now.
• You keep gravitatingyou volunteer for Intune work, or read incident write-ups for fun, or tinker with the bot's logs. Gravitation is the cheapest career signal you will ever get.
• A visible internal need existsthe cloud team is drowning, security has an open junior seat, or the AIOps tooling has no owner. Bridges into visible gaps are half the length.

When NOT to use

• Chasing all three at oncethree half-bridges reach nothing. Pick one, cross it, and remember the other two remain open; skills transfer between destinations more than the anxiety suggests.
• Certification-first, artifact-neveran AZ-104 badge with no deployed infrastructure reads exactly like "experienced with AI tools" did in pb-51. The exam is the spine, the artifacts are the proof.
• Before the fundamentals are honestif scripting review discipline (m4) and identity concepts (m5) are still shaky, bridge prep collapses into tutorial copying. Score yourself first; the matrix from pb-50 doesn't lie.

The recipe

1. 1.

   Choose with the three-question filter. For each destination, answer honestly: Which failure do I enjoy debugging? (broken deployment → cloud; suspicious log → security; noisy alert storm → AIOps). Which desk skill of mine is strongest? (endpoint/identity ops → cloud; triage instinct and skepticism → security; measurement and bot administration → AIOps). Which gap can I see from my seat? — the internal need you could fill within two quarters. Two of three answers pointing the same way is a decision; write it down with a date.

2. 2.

   Cloud bridge: AZ-104 spine, IaC artifact stream. Timeline: one quarter to exam-ready, one quarter of artifacts. Use the free tiers (Azure free account, or AWS with SAA if your org is AWS-shaped) and make AI your drill sergeant:

   Copy

   You are an AZ-104 study coach. I am a service-desk admin strong on
   Entra ID and Intune, weak on networking and storage. Quiz me with
   scenario questions (not definitions) on virtual networks, one at a
   time. After each answer, grade it, correct it with the CLI command
   or portal path involved, and log the topic if I scored under 80%.
   

   Artifacts: a Terraform or Bicep repo that stands up a small landing zone — resource group, vnet, one VM, one storage account, tagged and destroyed on schedule to protect the free tier:

   Copy

   az group create -n bridge-lab-rg -l centralindia
   az deployment group create -g bridge-lab-rg \
     --template-file main.bicep --parameters env=lab
   # teardown discipline is part of the artifact:
   az group delete -n bridge-lab-rg --yes --no-wait
   

   Have the LLM review your IaC the m4 way — you understand every line before it applies — and write the README as decisions, not steps. Your desk edge: you already run Entra ID and Intune, which is a third of the exam and the part cloud teams hate hiring for.

3. 3.

   Security ops bridge: desk-native skills, formalized. The desk already does junior SOC work without the title: phishing triage, account-compromise response, access reviews. The bridge formalizes it — spine: SC-200 (Microsoft-shaped) or Security+ then a SOC-analyst pathway. Artifact stream: a home lab ingesting your own logs (Sysmon → a free SIEM tier), five written triage narratives of simulated incidents using the m2 hypothesis discipline — every claim quoted from a log line — and KQL competence built with AI as translator:

   Copy

   Convert to KQL for Microsoft Sentinel, then explain each operator:
   "Sign-ins from a new country for any user, within 10 minutes of a
   password change, excluding known travel-notice users."
   

   Verify every generated query against sample data before you trust it — pb-01's audit habit, new domain. Your desk edge: you know what normal looks like for users and endpoints, which is the instinct SOCs cannot teach.

4. 4.

   AIOps bridge: own the intelligence layer you already operate. This is the shortest bridge from this track: pb-40..46 made you the person who runs bots, measures them honestly and governs their actions — AIOps generalizes that from support tickets to alerts, incidents and telemetry. Spine: PeopleCert AIOps Foundation for the vocabulary and an employer-legible credential. Artifact stream: an alert-noise study on your own monitoring (cluster a month of alerts the pb-42 way — frequency × actionability — and propose the suppression/correlation rules), plus one event-correlation or anomaly-detection lab with your platform's AIOps features (or open-source equivalents), written up with pb-44's honesty: what the model caught, what it missed, false-positive rate measured against a golden incident set.

5. 5.

   Whichever bridge: run the 90-day artifact cadence. Reuse pb-50's plan structure — four protected hours a week, one artifact per fortnight, a checkpoint conversation every 30 days. The LLM drafts the plan; you and the calendar make it true. Fortnights that produce only "watched/read/completed" get logged as misses, publicly to yourself.

6. 6.

   Convert internal gravity before applying external. Two quarters in, take the artifact stream to the destination team's lead: ask for one real task under supervision — a review, a runbook, a rotation shadow. Internal bridges cross on borrowed work; external applications then carry both the artifacts and the sentence "already doing X for the cloud/security/AIOps team."

7. 7.

   Update the pb-51 portfolio, don't fork it. The four-pillar skeleton stays; the bridge artifacts join it. The honest-measurement report and governance pack travel to all three destinations unchanged — they are the track's universal donors.

Make it yours

• AWS-shaped orgswap AZ-104 for Solutions Architect Associate and Bicep for Terraform-on-AWS; the desk-edge argument shifts from Entra to IAM, which you also already touch.
• No budget for examssequence artifacts first, voucher later: a landing-zone repo or a SIEM home lab costs nothing and outweighs the badge in interviews; use pb-50's plan review to make the employer fund the exam once the artifacts exist.
• MSP contextbridges can be internal service lines: cloud-managed services, security monitoring, AIOps for client estates. Pitch the artifact stream as a new billable practice and cross the bridge without changing employers.

Quality check

• One bridge, written down, with a date. The decision memo from step 1 exists and names the destination, the spine and the first three artifacts. Revisit quarterly; switching consciously is fine, drifting is not.
• Every artifact is understood, not just generated. For any IaC file, KQL query or correlation rule the AI helped write, you can explain each line cold — the m4 rule follows you across the bridge.
• Free-tier hygiene holds. Teardown scripts run, budget alerts are set, and no lab credential ever matches a work credential. A surprise cloud bill is a failed lab.
• The cadence survives contact with the queue. Artifact-per-fortnight is tracked like an SLA; two consecutive missed fortnights trigger a plan renegotiation, not silent abandonment.