On a Saturday morning in September 2023, a Play ransomware variant encrypted virtually every Windows system across the company in about two hours. More than 500 endpoints and over 125 virtual servers were down before 8 a.m. I was the Service Desk Supervisor on paper. Within the first hour I was directing the technical response, and I ran it through recovery and the hardening that followed. We paid no ransom, lost no critical production data, and had roughly 80% of operations back within 24 hours. The work during and after the incident is what moved me into an infrastructure leadership role the following year.