1.Mac Desktop support at a ~150 person ad agency for 1.5 years. While there, I got experience with networking (cabling, switch & router config) and system administration (ran backups, file, email, print and web servers).
2.System administrator/junior partner for a web hosting company serving small business. If it blinked, it was my responsibility. Did this as side work while working at 1&3

3.Mac lead at a ~500 person pharma company for 2 years. Moved to full time system administration for Windows, Unix and Mac servers. Paid a lot of attention to the security lead. Built some half-decent wireless networks for a 5 building campus.

4.Law School and worked for a VAR supporting small businesses. Support, sales and configuration on the side (3 years).

5.E-discovery (5 years) - project management, forensic document collection, review and team management. I learned to regret my decision about law school for these years.

6.Side legal practice- advising, writing/reviewing/negotiating contracts for small IT & infosec companies. Picked up pentesting & vulnerability management myself, got some experience with my legal clients. This turned into full time legal practice for about a year.

7. Security consulting. Got recruited by a consulting firm starting up a security practice. Moved from firm to firm to learn new stuff or experience new industries. Learned about putting security and IT in context of the business. Went from threat modeling to pentesting to policy & governance. Now I'm in the rapid maturation business.