A 4-week hands-on course that takes you through the 4 Pillars of AI Security framework. Build a defended RAG chatbot, a hardened AWS Bedrock deployment, a 2-agent system with human-in-the-loop controls, and a vibe-code audit pipeline. Every pillar gets a working portfolio project you can put on GitHub, your resume, and your next job conversation.
AI is the most under-defended layer of the modern stack. Security teams know they need to cover it. Engineers building AI features know they need to secure their work. Both groups end up reading the same scattered OWASP posts, frontier-lab blog posts, and certification material that does not include real implementation.
But you have never written the prompt-fencing code or tested it against the OWASP attack catalog.
But you have never set per-key cost caps, anomaly alerts, or a daily budget ceiling on AWS Bedrock.
But you have never built a human-in-the-loop gate or implemented memory validation on signed entries.
But you have never run a full audit chain: secret scanning, static analysis, dependency vulns, dangerous-function linting.
Every pillar in this course follows the same four-step loop. You do not read about security. You run the loop on a real project, then again, then again, then again.
Every pillar gets one week of focused work: 3 to 5 short video lessons, a step-by-step checklist guide, and one hands-on project that ends with a working artifact in the GitHub repo.
The four threats inside Pillar 1: prompt injection, data leakage, training data poisoning, hallucinations. You build a small Python chatbot that retrieves from a vector store, fences user input and retrieved content as untrusted, filters output for PII and secrets, and seeds canary tokens to detect leaks.
Outcome: a working defended chatbot in your GitHub repo, with the OWASP LLM Top 10 prompt injection test cases passing.
The four threats inside Pillar 2: API misuse, runaway costs, non-deterministic actions, insecure defaults. You provision Bedrock with Terraform, scope a least-privilege IAM role, set per-key request and token caps, enforce a daily cost ceiling, wire CloudTrail logging, and validate every output against a strict schema.
Outcome: a production-grade Bedrock deployment in IaC that translates directly to enterprise interviews. AWS hands-on experience that hiring managers verify.
The four threats inside Pillar 3: tool misuse, memory poisoning, cascading hallucinations, privilege compromise. You build a small orchestrator running two cooperating agents (researcher and communicator) with tool allowlisting, signed memory entries, human approval gates on destructive actions, loop depth caps, and a kill switch.
Outcome: a multi-agent system that demonstrates the discipline most production agent code lacks.
The four threats inside Pillar 4: insecure code generation, hardcoded secrets, dangerous functions, architectural blind spots. You build an audit chain that runs secret scanning, static analysis, dependency vulnerability scanning, dangerous-function detection, and an architectural review checklist on any AI-generated codebase.
Outcome: an audit pipeline you run on every AI-generated commit. The kind of artifact that gets you the architect interview.
Self-paced video lessons covering the threat, the defense, and the build, for each pillar.
3 to 5 short videos per pillar. Filmora-recorded screen walks of the actual build. No fluff, no padding.
Starter code, reference solution, and student fork pattern. Apache 2.0 licensed so you can use them in your portfolio.
One step-by-step audit checklist per pillar. Print them, walk them, apply them to systems you work on.
Pillar 2 puts you inside the AWS console doing IAM, CloudTrail, Terraform, and Bedrock the right way. Resume-grade experience.
The Free Training PDF expanded with founder-only annotations and an extra section on career framing.
Ask questions, share progress. Zach is active for the first 30 days post-purchase.
How to put your 4 projects on your resume, how to talk about them in interviews, what hiring managers look for.
Course materials, recordings, repo, and future updates. No subscription, no expiration.
The trifecta of cloud, AI, and API security taught together does not exist as a single track at any major training provider. The person who can speak fluently to all three is rare and well-paid. Typical salary bands in the US market:
Source: 2026 salary ranges from publicly posted job listings and industry surveys. Salary not guaranteed by this course. Salaries vary by region, employer, and individual negotiation.
Secure checkout via Stripe. 14-day refund guarantee. Lifetime access.
Plan on 5 to 8 hours per week for 4 weeks. Each pillar has 3 to 5 short video lessons (about 1 to 2 hours) plus the hands-on project (3 to 6 hours). Self-paced, so you can compress or stretch as needed.
Yes, for Pillar 2 (the Bedrock project). New AWS accounts are free to create. Plan on $5 to $15 in Bedrock and adjacent service costs across the project with disciplined Terraform teardown.
Pillar 1 (RAG chatbot) needs $5 to $10 in OpenAI or Anthropic API calls. Pillar 3 (agents) is $0 to $5. Pillar 4 (code audit) is $0. Total course infra cost: $10 to $30.
Yes. The course is designed for working engineers. Self-paced with lifetime access. Most students complete in 4 to 8 weeks.
The course is designed to make you a stronger candidate. It cannot guarantee employment. What it can do: give you 4 portfolio projects, 4 working systems on GitHub, and the technical vocabulary to interview confidently for AI security roles.
14 days, no questions asked. If the course is not what you expected, email zach@hackwithzach.com within 14 days of purchase for a full refund.
The price moves to $147 for the next cohort. The founder price does not return. If you want the $97 price, the waitlist is the path.
Zach Marcy. 10+ years in cybersecurity, focused on cloud, API, and AI security. Career-switcher turned security architect. Every lesson comes from systems he has defended in production.
Four pillars. Four weeks. Four projects that prove what you know. Lifetime access. $97 founder pricing for the first 30.
