Miami, Florida
Zach Marcy
Senior Security Consultant and Architect. Cybersecurity mentor specializing in Cloud, AI and API security. I teach it as HackWithZach.
About
Security architect by day. Teacher the rest of the time.
I'm Zach Marcy, known online as HackWithZach. I design and secure cloud environments that deploy and secure APIs and AI. My work covers bot mitigation, web application and API protection, DDoS defense and securing AI systems, and I connect the technical findings to decisions a business can act on.
I also teach cybersecurity. Through content, courses and community, I help people break into the field and grow within it. My mission is to lower the barrier to entry for aspiring security professionals: quality over quantity, depth over noise, and real-world relevance above all else.
The method is the same in every course. Build it minimally, threat model it, secure it, then break it. Real projects over theory.
Core expertise
- Security architecture
- Bot mitigation
- Web app and API security
- DDoS defense
- WAF tuning
- AI security
- AWS security
- Infrastructure as code
- Threat hunting
- Incident investigation
- Risk communication
Tools
- AWS
- QRadar
- CrowdStrike Falcon
- Security Onion
- Kibana
- Wireshark
- Terraform
- Python
- Anthropic Claude
Expertise
What I do
Twenty years in IT and six in cybersecurity, moving from security analyst to SOC architect, security architect and senior consultant. These are the areas I practice and teach.
Bot and automated abuse defense
- Architect and tune edge defenses against sophisticated automated threats, credential stuffing and botnets.
- Investigate automated abuse through request patterns, client reputation signals and TLS fingerprints.
Web application and API security
- Threat model and secure complex API ecosystems at enterprise scale.
- Tune WAF policies, custom rules and bot controls from log analysis, cutting false positives while keeping protection in place.
AI security
- Secure AI environments across the four pillars: LLMs, MCP and AI APIs, agents, and AI-written code.
- Build guardrails, least-privilege tool layers, human approval gates and CI scan gates, then attack them to prove they hold.
DDoS defense and high-stakes events
- Security readiness and incident response for the largest traffic events of the year.
- Onsite security consultant and architect in the command center during the 2026 World Cup, answering large attacks in real time.
Security operations and detection
- SOC architecture, investigation playbooks, threat hunting and log analysis.
- SIEM driven detection and incident investigation with QRadar, Security Onion, CrowdStrike Falcon and Kibana.
Cloud security architecture
- Design and secure cloud environments that deploy and secure APIs and AI, built as infrastructure as code on AWS.
- Translate findings for security teams, CISOs and leadership into decisions a business can act on.
Credentials
Certifications, speaking and education
| Certification | Issuer | Issued |
|---|---|---|
| EC-Council Certified Security Analyst (Practical) | EC-Council | Jun 2026 |
| Azure AI Fundamentals | Microsoft | Jan 2026 |
| Cybersecurity Analyst Specialization | IBM | Aug 2025 |
| Certified in Cybersecurity (CC) | ISC2 | Jul 2025 |
| Security+ | CompTIA | Dec 2022 |
Speaking
| Featured panelist, WiCS and NSBE careers panel | Florida International University | Apr 2026 |
Education
| Miami Dade College Certificate, Network Security. GPA 4.0 | 2022 |
| Georgia State University Psychology, minor in Computer Science | 1996 to 2001 |
Portfolio · Cloud and AI Security Engineer
Eight builds. Each one deployed weak, attacked, then hardened.
A hardened AWS foundation, an API and a detection pipeline on top of it, then the four AI pillars and a capstone that attacks all of it at once.
Links