Kostiantyn Sokolianskyi is Head of Information Security at Valesto in Odessa, Ukraine. Valesto is one of Ukraine's most prominent frozen filo dough producers, known for pies, puffs, and pastry products sold across Ukrainian supermarkets and exported to neighboring countries like Poland, Romania, and Hungary. The company runs automated production lines and holds ISO 22000 food-safety certification, which means, alongside conventional IT security, Kostiantyn's remit also touches the OT and ICS systems that keep manufacturing running, a focus that comes up later in this interview.
He's also one of our SAL2 Founding Operators, among the very first people to sit and pass the SAL2 exam, TryHackMe's practical certification built for mid-to-senior SOC roles.
What stands out talking to him isn't the title on his badge. It's that he still trains like an individual contributor. He's currently building out his organization's security function, so every argument he makes for continuous learning, he's proving on himself. Below, he talks about why that habit matters for anyone in the field, at any level of seniority.
On turning a casual habit into a discipline
How long have you been learning with THM?
My first room was in February 2022. For the next couple of years it stayed casual, just a room when I had a free evening, then nothing for months.
In August 2025 I suddenly reintroduced the field of cybersecurity to myself. I'd always thought of myself as a blue-team guy, and somewhere in the back of my head I assumed I'd just stay on that side forever. At some point it hit me that this is a bad thing to assume about your own career. If you only know how to defend, there's a whole half of the field you don't really get — the offensive half, which is the one actually coming at you. And it works the same in reverse for the red team.
One of my school teachers once told us you don't have to be the best at every subject, but your own field you should know cold. That line stuck with me, and it's why I now treat the whole of security as my field, including the offensive side I used to leave to other people. That's when I stopped dabbling and turned THM into a regular habit.
The short version: under a year of really focused practice, sitting on top of a much looser history that goes back to 2022.
How did you first hear about it?
My university recommended it, actually, as a way to get real hands-on practice alongside the theory. Then it showed up again at work, where we'd put interns through rooms to pick up the basic certs like SAL1 and PT1. So it's been following me around at every stage: first as a student, then on the job, and now as something I use for myself.
On why hands-on practice beats reading about it
Why do you think hands-on exposure is crucial to keeping skills current?
Security is something you build through practice. You can read every write-up about a technique and still freeze the first time you meet it in a live environment. In incident response that hurts, because the clock is already running and there's no time to figure it out from scratch. When you've drilled the thing beforehand, your hands already know roughly what to do once a real case lands. The field also keeps moving, so a lot of what you practiced last year has already aged out. Staying current really comes down to never stopping.
On the real barrier to team training
What's the biggest internal barrier to getting teams to prioritize continuous learning?
Time, almost every time. When you're running security operations, the urgent always beats the important. There's another alert, another ticket, and learning slides to "later, once things calm down." That moment never really arrives. The second issue is how training gets perceived. A lot of places still file it under nice-to-have, a box you tick, when really it's part of being ready to do the job. Until management treats skill development as basic infrastructure, on the same level as tooling, it stays the first thing cut whenever the team is slammed.
On justifying the investment
How do you or would you make the case for investing in platforms like TryHackMe?
I'd frame it around readiness and cost. You really don't want your team's first encounter with a given attack to happen during a real breach. The dwell time and damage from that will cost you far more than any subscription. A platform like THM lets people fail in a safe place and get good at something before it counts. There's a retention angle too. Strong analysts want to grow, and giving them a real path to do it keeps them around. The SAL certs add something a lot of training lacks: genuine proof that the skill is actually there. It's a hard practical exam, so passing it means something.
On going for SAL2 early
What made you decide to go for SAL2 early, before it was widely known?
Two reasons. First, the SAL approach measures the thing I think actually matters in an analyst: can they do the work under realistic conditions. That's the question worth asking, and a multiple-choice exam never gets near it. When a cert tests what the job genuinely demands, I want it. Second, the bar I work to is one I set myself, not one the job hands me, and going after something early is part of that. Going for it before it became a known quantity let me test myself against something genuinely hard, and it gave me a small part in shaping what the standard looks like while it was still forming.
On being a founding operator
What does being a founding operator mean to you, within your organization or the broader community?
It means I get to help build the thing and have a real say in how it takes shape. For the wider community, it's about helping set the bar for what a capable analyst should be able to demonstrate. I care about that a lot, since I both do this work and teach it. Closer to home it carries weight too. It signals real commitment to the craft, and it gives me credibility when I push my students and peers to take practical skill-building seriously.
On building the function from scratch
Have you brought THM into your org already?
In my teaching, definitely. Hands-on practice is basically the backbone of how I run my Security Operations and Incident Response courses, which is exactly the THM way of doing things. Inside my own organization the picture is earlier. I'm still building the security function mostly from scratch, so structured practical training sits on the roadmap and isn't fully rolled out yet. For now I'm the one pushing for it internally as the team grows.
How did you make the case for it internally?
Same way I'd argue for any security spend: tie it to risk and readiness. The pitch is simple. A team that's rehearsed incidents in a safe setting reacts faster and makes fewer mistakes when a real one hits, and that directly lowers our exposure.
On getting budget sign-off
What would you tell someone trying to get sign-off from their manager or procurement?
Start small and let results do the talking. Run a pilot, pick a metric you can actually track, like people completing a defined path or earning a SAL cert, and show your manager the before and after. Then translate it into language leadership and procurement respond to: shorter response times, fewer escalations, holding on to skilled people. Saying "it makes the team better" won't move anyone. Saying "it shortens how long an attacker sits in our network" is what gets budget signed off.
On what's next on the platform
What is your next goal on THM?
On the platform, I want to keep going deeper into the areas that map straight onto my day job, OT and ICS security above all, since that side keeps growing in what I do. I'm number one in Ukraine right now, so the next rung is the global leaderboard, along with the rooms I find hardest and whatever new certs show up.
On what's next in his career
What is your next goal in your career and life?
Professionally, my goal is to mature my organization's security program into something robust and well-governed: building out the ISMS, strengthening our OT/ICS defenses, and reaching a level of compliance the business can stand behind. Alongside that, I want to keep growing as a leader and keep teaching, because passing the craft on to the next generation of analysts matters to me.
There's one more direction I'm actively moving into, and that's the newer technologies built around AI. I'm taking it seriously as the future of this field, and I think that future arrives a lot sooner than most people assume. Both sides will reach for it, defenders and attackers alike. It's an enormous force, and the real skill is learning to harness it and keep it in check.
On what he'd tell the Ukrainian security community
Anything else you'd like to add?
If anyone's on the fence, especially here in the Ukrainian security community, my advice is to take hands-on learning seriously. For us the threats are very real, and the people who stay sharp are the ones who keep practicing. THM makes that genuinely accessible, and the habit compounds over the years.
One more thing I'd pass on: keep going even when there's nothing to show for it yet, when not even you can see the progress. That's the part where most people give up. In my experience the results arrive all at once, usually right when you've stopped looking for them.
