Your learning path
AI Security Architect
Design how AI systems handle data, call tools and enforce access boundaries.
First session
Start with one task
Sketch a fictional RAG assistant that can call one tool. Mark where data crosses a trust boundary and who can authorise each action.
Open the first skill guide →Use a training lab or a system you own. Testing any other system needs written permission.
What this work involves
- Design and review reference architectures for LLM, RAG and agentic systems.
- Set identity and access boundaries for agents and tools (least-privilege IAM across cloud accounts).
- Map how agents chain tools and calls, and where that chain can be abused.
- Assess retrieval pipelines and vector stores for injection and data-exposure risk, feeding red-team and AppSec findings back into the design.
Learn in order
Your learning steps
Start with the first skill. Each step has a few resources here and a link to the full guide. Skip material you already know.
01AI system threat modelling and secure architectureProduce a design that makes trust boundaries and control decisions explicit.
- OWASP Top 10 for LLM Applications OWASP GenAI Security Project, guide, free, about 2 h, introUse the risk categories as prompts when reviewing an LLM application design.
- MITRE ATLAS MITRE, guide, free, about 3 h, workingGives you a tactics and techniques matrix for adversarial ML attacks that you can use directly in threat modelling sessions.
- NIST AI Risk Management Framework NIST, standard, free, about 3 h, workingUse its risk categories and lifecycle structure to organise an AI risk assessment.
02LLM security: prompt injection, jailbreaks, output handlingEvery posting assumes fluency in how LLMs fail (prompt injection, jailbreaks, data leakage) as input to design decisions.
- Prompt Injection Prevention Cheat Sheet OWASP Cheat Sheet Series, guide, free, about 1 h, workingShort, practical control checklist you can reuse directly in a design review or a client report.
- Web LLM attacks PortSwigger Web Security Academy, lab, free, about 3 h, workingPractise attacks against an LLM-backed application in authorised browser-based labs.
- garak: LLM vulnerability scanner NVIDIA, tool, free, about 2 h, workingAn open-source scanner you can point at a model to probe for jailbreaks, prompt injection, and data leakage, similar in spirit to running nmap against a network.
03Agent and agentic system security: tool use, permissions, memory, multi-agentMost roles now assume agentic systems, meaning you need to reason about tool chains and autonomous action, not just single model calls.
- Agentic AI: Threats and Mitigations OWASP GenAI Security Project (Agentic Security Initiative), guide, free, about 2 h, introGives you a shared vocabulary and threat model for agent-specific risks like tool misuse and excessive autonomy before you look at any single framework.
- Prompt injection (series) Simon Willison, guide, free, about 3 h, workingDocumented prompt-injection examples and commentary on how they affect applications and agents.
- AI Red Teaming, Prompt Hacking and AI Security Masterclass Learn Prompting, course, USD 1199, about 25 h, advancedA structured, hands-on path from prompt hacking basics to agent and tool-use attacks, built by the team behind the HackAPrompt competitions, if you want a paid certification track.
04Securing model and agent workloads on cloud platformsArchitectures are deployed on real cloud accounts, so you need hands-on knowledge of at least one provider's security primitives.
- Securing generative AI: An introduction to the Generative AI Security Scoping Matrix AWS Security Blog, guide, free, about 2 h, workingGives you a working model for figuring out which security responsibilities are yours versus the provider's for any generative AI deployment.
- Azure security baseline for Azure OpenAI Microsoft Learn, guide, free, about 2 h, workingLists the specific network, identity and data controls to configure when you run a model workload on Azure.
- Google's Secure AI Framework (SAIF) Google, guide, free, about 1 h, introSets out Google's own conceptual framework for securing AI systems across the ecosystem, useful for comparing against AWS and Azure approaches.
05Identity and least privilege for agents and toolsSetting least-privilege access for agents and tools is named directly in the core skill list and is where architecture becomes concrete.
- Create a service role for Amazon Bedrock Agents AWS, guide, free, about 2 h, workingShows a concrete example of scoping an IAM role down to exactly what an agent's action groups and knowledge bases need.
- MCP Authorization specification Model Context Protocol, standard, free, about 3 h, advancedDefines how tokens should be scoped and validated between an agent client and the tools it calls, including the confused deputy problem.
- AI Controls Matrix (AICM) Cloud Security Alliance, standard, free, about 2 h, workingIncludes a dedicated identity and access management domain with control objectives you can use to audit an agent deployment.
06Application security for LLM-backed softwareArchitects need enough secure-coding grounding to review implementation against the design, even without writing production code daily.
- OWASP Top 10 for LLM Applications OWASP GenAI Security Project, standard, free, about 2 h, introThe reference risk list you will map every LLM app review against, so start here.
- Guidelines for secure AI system development UK National Cyber Security Centre, guide, free, about 2 h, workingCovers secure design, build, deployment and maintenance for AI systems the way an AppSec review checklist would.
- HackAPrompt Learn Prompting, lab, free, about 3 h, introHands-on practice crafting prompt injection payloads, the equivalent of learning SQL injection by doing it.
07RAG pipeline security: retrieval, vector stores, data poisoningRAG pipelines (vector stores, retrieval) are a common attack surface architects are expected to threat model even though only some postings name it explicitly.
- OWASP Top 10 for LLM Applications OWASP GenAI Security Project, standard, free, about 3 h, introCovers vector and embedding weaknesses and supply chain risk, which is the standard vocabulary for talking about RAG-specific threats.
- PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation arXiv, paper, free, about 2 h, advancedA research paper on injecting malicious documents into a knowledge base to influence the answers a RAG system produces.
- garak: LLM vulnerability scanner NVIDIA, tool, free, about 2 h, workingLets you probe a deployed LLM or RAG-backed app for data leakage and injection issues instead of only reasoning about it on paper.
Put it into practice
Threat model and reference architecture for a RAG plus agent pipeline
Allow about 10 hours, plus setup. This is a practice project, not a certification or a measure of job readiness.
Threat model a fictional pipeline that combines a RAG retrieval step with an agent that can call tools, then write a one-page reference architecture with explicit least-privilege decisions. Architecture is named in 6 of the 7 postings in this cluster and the deliverable they name is design review, so the artefact to show is a design plus the reasoning behind each access boundary.
Use fictional data and an authorised sandbox. Check model, cloud and licence costs before starting.
Project steps
- Sketch the fictional pipeline: a user query, a retrieval step against a vector store, an LLM call, and an agent that can call at least 2 external tools (for example, a ticketing API and a file store).
- List every trust boundary in the diagram: user to app, app to vector store, app to LLM, LLM to agent, agent to each tool.
- For each boundary, list at least one concrete threat (prompt injection via retrieved documents, tool call abuse, excessive agent permissions, vector store poisoning).
- For each tool the agent can call, define the minimum permission set it actually needs and write down what you are deliberately not granting.
- Decide and document how you would authenticate and scope the agent's identity separately from the end user's identity.
- Write the one-page reference architecture: diagram plus a short table of components, trust boundaries, and the least-privilege decision for each.
- Cross-check your threats against MITRE ATLAS and the OWASP LLM Top 10 to see what you missed.
- Save the diagram and the one-pager as a portfolio pair you can walk through in an interview.
What to produce: A one-page reference architecture document with a threat list and explicit least-privilege decisions for a fictional RAG plus agent pipeline.
Check your work
- every trust boundary in the diagram has at least one named threat, not a generic 'security risk' label.
- every tool the agent calls has a written minimum permission set and a note on what was denied.
- the agent's identity is described separately from the end user's identity, not assumed to be the same.
- at least one threat was found by cross-checking against MITRE ATLAS or the OWASP LLM Top 10 that was not on your first pass.
- you can explain, without notes, why one specific permission was denied to the agent.
- the final document fits on one page and includes a diagram.
Career context
Security pay by experience
General security benchmarks, not an AI-security salary forecast. Skills and responsibility matter; years of experience alone do not determine pay.
United Kingdom GBP · reported annual salary
Example specialism: security engineering. These are the survey’s experience bands, not AI-security pay or job-level guarantees.
- Experience reported
1–3 years
£45,000–£59,7502026 reported salary rangeNot a zero-experience starting salary.
- Experience reported
4–6 years
£62,500–£75,7502026 reported salary range - Experience reported
7–9 years
£81,000–£98,5002026 reported salary range - Experience reported
10–12 years
£100,000–£115,7502026 reported salary range
United States USD · reported annual salary
Example specialism: security engineering. These are the survey’s experience bands, not AI-security pay or job-level guarantees.
- Experience reported
1–3 years
$59,500–$78,0002026 reported salary rangeNot a zero-experience starting salary.
- Experience reported
4–6 years
$79,750–$96,5002026 reported salary range - Experience reported
7–9 years
$106,500–$129,2502026 reported salary range - Experience reported
10–12 years
$130,500–$150,7502026 reported salary range
Reported annual salary. No bonus, equity or sales OTE added; the source does not explicitly confirm base-only pay. UK and US use separate scales and currencies; no conversion. These are snapshots across people, not a guaranteed pay progression.
Sources and methodology
Sources checked 2026-09-26. These benchmarks are separate from this guide’s small AI-security job sample. Published ranges can overlap and differ by specialism, location and employer.
United Kingdom
Cybershark Recruitment’s 2026 United Kingdom survey, Security Engineering row on page 8. Four published experience bands are reproduced directly, with no interpolation or currency conversion. The whole survey reports 3,861 respondents; counts within each role/experience band and the statistical definition of the range are not provided. Treat this as a directional recruiter benchmark, not a representative national estimate or a salary prediction. Salary and performance bonuses are reported separately, but the report does not explicitly define the table as base-only. We therefore label it reported annual salary, not verified base pay. No bonus, equity, benefits or sales OTE have been added. Zero-experience pay and AI-specific premiums are not established by this table.
- Cybershark Recruitment: United Kingdom Cyber Security Salary Survey, page 8 (PDF) (2026)
Published salary ranges for Security Engineering, by years of experience. Directly transcribed from the report’s table; no pooled job-posting ranges or invented seniority labels.
United States
Cybershark Recruitment’s 2026 United States survey, Security Engineering row on page 7. Four published experience bands are reproduced directly, with no interpolation or currency conversion. The whole survey reports 7,028 respondents; counts within each role/experience band and the statistical definition of the range are not provided. Treat this as a directional recruiter benchmark, not a representative national estimate or a salary prediction. Salary and performance bonuses are reported separately, but the report does not explicitly define the table as base-only. We therefore label it reported annual salary, not verified base pay. No bonus, equity, benefits or sales OTE have been added. Zero-experience pay and AI-specific premiums are not established by this table.
- Cybershark Recruitment: United States Cyber Security Salary Survey, page 7 (PDF) (2026)
Published salary ranges for Security Engineering, by years of experience. Directly transcribed from the report’s table; no pooled job-posting ranges or invented seniority labels.
How this sample informed the learning order
This path uses 7 postings from a 48-posting research dataset compiled on 24 September 2026, not a live vacancy feed. The counts below show how many selected postings explicitly mention each skill. They describe this sample only, not demand across the job market. The learning order also reflects prerequisites.
- AI system threat modelling and secure architecture6 / 7
- LLM security: prompt injection, jailbreaks, output handling7 / 7
- Agent and agentic system security: tool use, permissions, memory, multi-agent6 / 7
- Securing model and agent workloads on cloud platforms5 / 7
- Identity and least privilege for agents and tools3 / 7
- Application security for LLM-backed software4 / 7
- RAG pipeline security: retrieval, vector stores, data poisoning3 / 7
Reference frameworks for this path
- MITRE ATLAS
Use its tactics and techniques to cross-check the threat list against real adversary behaviour against AI/ML systems.
- OWASP Top 10 for LLM Applications 2025
A structured checklist of LLM application risks to run the reference architecture against before calling it done.
- OWASP Agentic Security Initiative (ASI) outputs
Emerging agent-specific risk categories, useful for the tool-call and agent identity threats in this exercise, though the project page itself is currently unreachable so treat content as provisional.
- NCSC Guidelines for secure AI system development
Lifecycle guidance to frame the reference architecture's design and deployment sections.