Your learning path
AI Security Consultant
Help client teams understand AI security risks and plan the work needed to address them.
First session
Start with one task
Write a short brief for a fictional client introducing an AI assistant. Draft the questions you would ask in a security workshop.
Open the first skill guide →Use a training lab or a system you own. Testing any other system needs written permission.
What this work involves
- Run workshops and conversations with client teams who are not security specialists.
- Translate model and application risk into terms a client's own staff can act on.
- Anchor engagement scoping to a named governance framework so the client can see what was covered.
- Read enough of a client's cloud environment and code to question technical findings credibly.
Learn in order
Your learning steps
Start with the first skill. Each step has a few resources here and a link to the full guide. Skip material you already know.
01Advisory and customer-facing delivery skillsThis is the core of the role even though it shows in less than half the postings by keyword: running workshops, pre-sales conversations, and exec presentations is what separates this cluster from purely technical roles.
- AI Risk Management Framework NIST, standard, free, about 3 h, introThe framework most clients already reference, so you need to speak its language before you can advise on it.
- ISO/IEC 42001, AI management system standard ISO/IEC, standard, free, about 2 h, workingThe management-system standard clients pursuing AI governance certification will ask you about.
- Multilayer framework for good cybersecurity practices for AI ENISA, guide, free, about 2 h, workingA structured way to walk a client through AI security practices across the organisation, not just the model layer.
02LLM security: prompt injection, jailbreaks, output handlingYou need to explain how these models fail in plain language a client's own staff can act on.
- OWASP Top 10 for LLM Applications OWASP GenAI Security Project, standard, free, about 3 h, introUse this list of LLM application risks to structure a review, including prompt injection and unsafe output handling.
- Prompt Injection Prevention Cheat Sheet OWASP Cheat Sheet Series, guide, free, about 1 h, workingShort, practical control checklist you can reuse directly in a design review or a client report.
- Web LLM attacks PortSwigger Web Security Academy, lab, free, about 3 h, workingPractise attacks against an LLM-backed application in authorised browser-based labs.
03Securing model and agent workloads on cloud platformsMost engagements happen on a client's cloud environment, so you need enough grounding to talk credibly about what you are assessing.
- Securing generative AI: An introduction to the Generative AI Security Scoping Matrix AWS Security Blog, guide, free, about 2 h, workingGives you a working model for figuring out which security responsibilities are yours versus the provider's for any generative AI deployment.
- Azure security baseline for Azure OpenAI Microsoft Learn, guide, free, about 2 h, workingLists the specific network, identity and data controls to configure when you run a model workload on Azure.
- Google's Secure AI Framework (SAIF) Google, guide, free, about 1 h, introSets out Google's own conceptual framework for securing AI systems across the ecosystem, useful for comparing against AWS and Azure approaches.
04Python and coding for AI security workYou are not always writing production code, but you need enough coding literacy to follow a technical finding and question it.
- Hugging Face LLM Course Hugging Face, course, free, about 12 h, introLearn to use and fine-tune open models through Python examples. Basic Python knowledge is useful before starting.
- LangChain security guidance LangChain, guide, free, about 1 h, introRead the security considerations for applications that give models access to tools and data.
- Damn Vulnerable LLM Agent WithSecure Labs (now Reversec), lab, free, about 4 h, workingRun a deliberately vulnerable agent locally, inspect its code and practise finding and fixing security issues.
05AI governance, risk and compliance: NIST AI RMF, ISO/IEC 42001, EU AI Act, CSA AICMScoping an assessment or workshop usually means anchoring it to a named framework so the client can see what was covered.
- Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST-AI-600-1) NIST, standard, free, about 2 h, workingRead the risks and suggested actions specific to generative AI alongside the base NIST AI Risk Management Framework.
- NIST AI RMF Playbook NIST, tool, free, about 3 h, workingTurns the RMF's four functions into concrete, actionable suggestions you can use as a checklist when running an actual assessment.
- EU AI Act, full text and article-by-article explorer artificialintelligenceact.eu, regulation, free, about 3 h, workingGives the actual legal text of the first binding cross-sector AI law, with a browsable structure that is far easier to work through than the Official Journal PDF.
06RAG pipeline security: retrieval, vector stores, data poisoningRetrieval-augmented systems come up often enough in client environments that you need to know their specific risks.
- OWASP Top 10 for LLM Applications OWASP GenAI Security Project, standard, free, about 3 h, introCovers vector and embedding weaknesses and supply chain risk, which is the standard vocabulary for talking about RAG-specific threats.
- PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation arXiv, paper, free, about 2 h, advancedA research paper on injecting malicious documents into a knowledge base to influence the answers a RAG system produces.
- garak: LLM vulnerability scanner NVIDIA, tool, free, about 2 h, workingLets you probe a deployed LLM or RAG-backed app for data leakage and injection issues instead of only reasoning about it on paper.
07Agent and agentic system security: tool use, permissions, memory, multi-agentNamed in 1 of the 5 postings, and it is the risk area to read up on when a client has already deployed a tool-using assistant.
- Agentic AI: Threats and Mitigations OWASP GenAI Security Project (Agentic Security Initiative), guide, free, about 2 h, introGives you a shared vocabulary and threat model for agent-specific risks like tool misuse and excessive autonomy before you look at any single framework.
- MITRE ATLAS (Adversarial Threat Landscape for AI Systems) MITRE, standard, free, about 3 h, workingCatalogs real adversary tactics and techniques against AI and agentic systems, including tool poisoning and agent command and control, so you can map risks the way a threat intel analyst would.
- Prompt injection (series) Simon Willison, guide, free, about 3 h, workingDocumented prompt-injection examples and commentary on how they affect applications and agents.
Put it into practice
Run a client-ready workshop and scope an assessment
Allow about 8 hours, plus setup. This is a practice project, not a certification or a measure of job readiness.
Produce two artefacts a consultant actually delivers: a one-hour workshop outline for a non-security audience, and a written scope for an AI security assessment of a fictional client. One thing a client can sit through, one thing a client can sign.
Use fictional data and an authorised sandbox. Check model, cloud and licence costs before starting.
Project steps
- Invent a fictional client: one paragraph describing their business, the AI system they use or are building, and their main worry.
- Draft a one-hour workshop outline for that client's non-technical staff, covering timing, sections, at least one interactive exercise, and the top 3 risks you will explain.
- Write the workshop content for one section in full, including the plain-language explanation and one concrete example a non-security person would understand.
- Deliver the workshop once, to anyone willing to listen for an hour, even a friend or family member, and note what confused them.
- Revise the outline based on that feedback and record what you changed and why.
- Write a scope document for an AI security assessment of the same fictional client: objectives, in-scope systems, out-of-scope items, methodology, timeline, and deliverables.
- Anchor the scope document to one named framework, stating explicitly which parts of the framework you are and are not covering.
- Have someone else read both documents cold and tell you what they would ask before agreeing to the work.
What to produce: A workshop outline with one fully written section, delivery notes from a real run-through, and a written assessment scope document tied to a named framework.
Check your work
- the workshop outline fits in one hour including the interactive exercise.
- the workshop content avoids jargon a non-security person would not know, or defines it plainly where used.
- you actually delivered the workshop to a real person and recorded their feedback.
- the scope document states clearly what is out of scope, not just what is in scope.
- the scope document names a specific framework and states which parts of it are covered.
- A cold reader could tell you the effort, the cost basis, the deliverable and the timeline from the scope document alone.
Career context
Security pay by experience
General security benchmarks, not an AI-security salary forecast. Skills and responsibility matter; years of experience alone do not determine pay.
United Kingdom GBP · reported annual salary
Example specialism: security engineering. These are the survey’s experience bands, not AI-security pay or job-level guarantees.
- Experience reported
1–3 years
£45,000–£59,7502026 reported salary rangeNot a zero-experience starting salary.
- Experience reported
4–6 years
£62,500–£75,7502026 reported salary range - Experience reported
7–9 years
£81,000–£98,5002026 reported salary range - Experience reported
10–12 years
£100,000–£115,7502026 reported salary range
United States USD · reported annual salary
Example specialism: security engineering. These are the survey’s experience bands, not AI-security pay or job-level guarantees.
- Experience reported
1–3 years
$59,500–$78,0002026 reported salary rangeNot a zero-experience starting salary.
- Experience reported
4–6 years
$79,750–$96,5002026 reported salary range - Experience reported
7–9 years
$106,500–$129,2502026 reported salary range - Experience reported
10–12 years
$130,500–$150,7502026 reported salary range
Reported annual salary. No bonus, equity or sales OTE added; the source does not explicitly confirm base-only pay. UK and US use separate scales and currencies; no conversion. These are snapshots across people, not a guaranteed pay progression.
Sources and methodology
Sources checked 2026-09-26. These benchmarks are separate from this guide’s small AI-security job sample. Published ranges can overlap and differ by specialism, location and employer.
United Kingdom
Cybershark Recruitment’s 2026 United Kingdom survey, Security Engineering row on page 8. Four published experience bands are reproduced directly, with no interpolation or currency conversion. The whole survey reports 3,861 respondents; counts within each role/experience band and the statistical definition of the range are not provided. Treat this as a directional recruiter benchmark, not a representative national estimate or a salary prediction. Salary and performance bonuses are reported separately, but the report does not explicitly define the table as base-only. We therefore label it reported annual salary, not verified base pay. No bonus, equity, benefits or sales OTE have been added. Zero-experience pay and AI-specific premiums are not established by this table.
- Cybershark Recruitment: United Kingdom Cyber Security Salary Survey, page 8 (PDF) (2026)
Published salary ranges for Security Engineering, by years of experience. Directly transcribed from the report’s table; no pooled job-posting ranges or invented seniority labels.
United States
Cybershark Recruitment’s 2026 United States survey, Security Engineering row on page 7. Four published experience bands are reproduced directly, with no interpolation or currency conversion. The whole survey reports 7,028 respondents; counts within each role/experience band and the statistical definition of the range are not provided. Treat this as a directional recruiter benchmark, not a representative national estimate or a salary prediction. Salary and performance bonuses are reported separately, but the report does not explicitly define the table as base-only. We therefore label it reported annual salary, not verified base pay. No bonus, equity, benefits or sales OTE have been added. Zero-experience pay and AI-specific premiums are not established by this table.
- Cybershark Recruitment: United States Cyber Security Salary Survey, page 7 (PDF) (2026)
Published salary ranges for Security Engineering, by years of experience. Directly transcribed from the report’s table; no pooled job-posting ranges or invented seniority labels.
How this sample informed the learning order
This path uses 5 postings from a 48-posting research dataset compiled on 24 September 2026, not a live vacancy feed. The counts below show how many selected postings explicitly mention each skill. They describe this sample only, not demand across the job market. The learning order also reflects prerequisites.
- Advisory and customer-facing delivery skills2 / 5
- LLM security: prompt injection, jailbreaks, output handling4 / 5
- Securing model and agent workloads on cloud platforms4 / 5
- Python and coding for AI security work4 / 5
- AI governance, risk and compliance: NIST AI RMF, ISO/IEC 42001, EU AI Act, CSA AICM2 / 5
- RAG pipeline security: retrieval, vector stores, data poisoning2 / 5
- Agent and agentic system security: tool use, permissions, memory, multi-agent1 / 5
Reference frameworks for this path
- NIST AI RMF 1.0 + Generative AI Profile (AI 600-1)
A common anchor framework for scoping an assessment so the client can see what was and was not covered.
- NCSC Guidelines for secure AI system development
Useful plain-language source material when building workshop content for a non-security audience.