---
title: "Matias Zapf"
description: "Software engineer at the intersection of security, data, and ML — drawn to detecting fraud, vulnerabilities, and threats. Now focused on cyberdefense."
source: "https://zapf.dev/about/"
---

## Profile

Software engineer at the intersection of security, data, and ML — drawn to detecting fraud, vulnerabilities, and threats. Now focused on **[cyberdefense](https://undef.edu.ar/fadena/carreras-de-grado/licciberdefensa/)**.

## What I'm building

Designing multi-agent systems and putting them to work — not as demos, but as pipelines that produce real output under hard verification.

- **[ensamble](https://github.com/MatiasZapf/ensamble)** — a multi-agent SDLC orchestration framework where reliability is *architectural*, not prompted: the agent's output is treated as untrusted input. Code edits are gated behind an approved plan, and the spec and acceptance checks stay frozen during the build. A fail-closed engine computes completion by re-running the project's real checks instead of believing the model, and a secret-scanning gate hard-blocks credentials in agent writes. Secure-by-default.
- **[monitor](https://github.com/MatiasZapf/monitor)** — a private, multi-source Python + Rust ingest service with messaging bots, running unattended 24/7. Strict TDD, architecture contracts that keep private data out of the broadcast path — enforced as a hard build gate — and a hardened secrets path: keys in the OS keyring, fail-loud, with adversarial leak-tests asserting no token reaches logs or sinks.
- **Knowledge graphs & technical writing** — I design knowledge systems and the pipelines that produce them. Privately, **[apuntes.md](https://apuntes.md)** is an agentic pipeline (auditor–enricher loops, deterministic quality gates) that rebuilds my Cyberdefense coursework into curated, audited study material — theory, solved practice, and atomic notes — grounded in evidence-based pedagogy ([Ausubel](https://en.wikipedia.org/wiki/David_Ausubel) · [Sweller](https://en.wikipedia.org/wiki/John_Sweller) · [Mayer](https://en.wikipedia.org/wiki/Richard_E._Mayer) · [Bloom](https://en.wikipedia.org/wiki/Bloom%27s_taxonomy) · [Matuschak](https://notes.andymatuschak.org/Evergreen_notes)). Publicly, I write long-form posts on my **[blog](/blog/)** and maintain a **[technical atlas](/atlas/)** — a knowledge graph of security concepts as atomic, interlinked nodes, navigable as a D3 force-directed graph.

## Experience

### Programming Instructor — [Silicon Misiones](https://siliconmisiones.gob.ar/)
*March 2023 – May 2025* · Remote · Cohorts of ~50 students with prior programming experience

Designed and delivered a 24-class hands-on curriculum across three progressive modules, taught live through interactive Google Colab notebooks where theory and exercises lived inline — authored with explicit pedagogical scaffolding (advance organizers, worked examples, retrieval prompts, error taxonomies).

- **Python foundations:** types and control flow, pattern matching, OOP and design patterns, error handling, modules, and file I/O — applied to ETL exercises on real-world datasets.
- **Intermediate / advanced Python:** generators and lazy evaluation, comprehensions, closures and decorators (timer, debug, memoize), regex-driven validation and extraction, ETL pipelines built around `@dataclass` and `match/case`.
- **Data Science & AI:** NumPy vectorization, REST API integration with caching, Pandas data wrangling, data visualization with Seaborn/matplotlib, SQL and SQLAlchemy (Core/ORM), applied transfer learning via Hugging Face pipelines, and a closing module on exploratory data analysis (EDA).

## Education

- **[B.S. in Cyberdefense](https://undef.edu.ar/fadena/carreras-de-grado/licciberdefensa/)** — [UNDEF](https://undef.edu.ar/) · *2026 – 2029, in progress*
- **Online courses:** [CS50](https://www.edx.org/cs50) (Harvard), [The Missing Semester](https://missing.csail.mit.edu/) (MIT), [Python Programming MOOC](https://programming-22.mooc.fi/) (Helsinki)

## Technical Skills

| Category | Technologies |
|---|---|
| Languages & systems | Python, TypeScript, Rust, SQL, Bash, Linux |
| AI & agent systems | multi-agent orchestration, LLM application development, agentic pipelines, cross-model adversarial review, RAG, MCP server development, prompt engineering, NLP (Transformers) |
| Security engineering | threat modeling (STRIDE), web hardening (CSP, security headers), secrets management & scanning, supply-chain & SAST hygiene, secure SDLC, MITRE ATT&CK, NIST CSF & ISO 27001 (fundamentals) |
| Engineering practices | TDD, hexagonal architecture (ports & adapters), architecture contracts (import-linter), CI/CD gates, accessibility testing (WCAG 2.2, axe) |
| Backend & web | Python (Django, FastAPI, async, Pydantic), Rust (Axum, Tokio), PostgreSQL (multi-tenant RLS, SQLAlchemy), Next.js, REST APIs, web scraping & bot automation |
| Data analytics | Power BI, Pandas, NumPy, Matplotlib, Seaborn, scikit-learn, Jupyter |
| Knowledge engineering & technical writing | knowledge graphs (D3 force-directed), atomic notes (Zettelkasten), agentic content pipelines, static-site generation (Astro, Quartz), MDX, technical documentation, evidence-based pedagogy |
| Spoken languages | Spanish (native), English (B2), Portuguese (basic) |

## Contact

- **Email:** [matias@zapf.dev](mailto:matias@zapf.dev)
- **LinkedIn:** [linkedin.com/in/zapf](https://www.linkedin.com/in/zapf/)