Your learning path
AI Security Engineer
Build and test security controls for applications that use language models and agents.
First session
Start with one task
Build a small local LLM app with fictional data. Record what data it sends to the model and which actions the model can trigger.
Open the first skill guide →Use a training lab or a system you own. Testing any other system needs written permission.
What this work involves
- Write and harden code that uses or wraps LLMs and agents, closing off ways it can be misused.
- Review agentic systems that call tools, APIs, or MCP, and lock down tool-calling permissions.
- Apply application security practice (secure SDLC, code review, vulnerability management) to AI-specific code paths.
- Secure the cloud infrastructure the models and agents run on, and review architecture before it's built.
Learn in order
Your learning steps
Start with the first skill. Each step has a few resources here and a link to the full guide. Skip material you already know.
01LLM security: prompt injection, jailbreaks, output handlingYou need to know how prompt injection, context handling and model output risk actually work before you can code a fix for them.
- OWASP Top 10 for LLM Applications OWASP GenAI Security Project, standard, free, about 3 h, introUse this list of LLM application risks to structure a review, including prompt injection and unsafe output handling.
- Prompt Injection Prevention Cheat Sheet OWASP Cheat Sheet Series, guide, free, about 1 h, workingShort, practical control checklist you can reuse directly in a design review or a client report.
- Web LLM attacks PortSwigger Web Security Academy, lab, free, about 3 h, workingPractise attacks against an LLM-backed application in authorised browser-based labs.
02Agent and agentic system security: tool use, permissions, memory, multi-agentMost roles are securing agents that take actions, not just chat, so tool-calling and permission boundaries are core work.
- Agentic AI: Threats and Mitigations OWASP GenAI Security Project (Agentic Security Initiative), guide, free, about 2 h, introGives you a shared vocabulary and threat model for agent-specific risks like tool misuse and excessive autonomy before you look at any single framework.
- MITRE ATLAS (Adversarial Threat Landscape for AI Systems) MITRE, standard, free, about 3 h, workingCatalogs real adversary tactics and techniques against AI and agentic systems, including tool poisoning and agent command and control, so you can map risks the way a threat intel analyst would.
- Prompt injection (series) Simon Willison, guide, free, about 3 h, workingDocumented prompt-injection examples and commentary on how they affect applications and agents.
03Python and coding for AI security workThis is a hands-on building role, most postings name Python explicitly as the working language.
- Hugging Face LLM Course Hugging Face, course, free, about 12 h, introLearn to use and fine-tune open models through Python examples. Basic Python knowledge is useful before starting.
- LangChain security guidance LangChain, guide, free, about 1 h, introRead the security considerations for applications that give models access to tools and data.
- Damn Vulnerable LLM Agent WithSecure Labs (now Reversec), lab, free, about 4 h, workingRun a deliberately vulnerable agent locally, inspect its code and practise finding and fixing security issues.
04Securing model and agent workloads on cloud platformsThe apps and agents you secure run on AWS, Azure or GCP, so you need to lock down the infrastructure layer too.
- Securing generative AI: An introduction to the Generative AI Security Scoping Matrix AWS Security Blog, guide, free, about 2 h, workingGives you a working model for figuring out which security responsibilities are yours versus the provider's for any generative AI deployment.
- Azure security baseline for Azure OpenAI Microsoft Learn, guide, free, about 2 h, workingLists the specific network, identity and data controls to configure when you run a model workload on Azure.
- Google's Secure AI Framework (SAIF) Google, guide, free, about 1 h, introSets out Google's own conceptual framework for securing AI systems across the ecosystem, useful for comparing against AWS and Azure approaches.
05AI system threat modelling and secure architectureYou are often the one deciding how a secure agent or RAG pipeline should be structured before it is built.
- NIST AI Risk Management Framework NIST, standard, free, about 3 h, workingUse its risk categories and lifecycle structure to organise an AI risk assessment.
- Guidelines for secure AI system development UK National Cyber Security Centre, guide, free, about 2 h, workingWalks through secure design, development, deployment and maintenance decisions for AI systems in plain, practitioner language.
06AI red teaming and adversarial testingYou test your own guardrails against known attack payloads, even though full-time offensive testing is a separate cluster.
- PyRIT Microsoft, tool, free, about 5 h, workingAn open source framework for automating red team probes against generative AI systems, useful once manual testing gets repetitive.
- Red Teaming Language Models with Language Models arXiv (DeepMind), paper, free, about 2 h, advancedShows how one language model can be used to systematically generate attacks against another, a technique now behind several automated red teaming tools.
07Model Context Protocol security: servers, tool poisoning, auth6 of the 16 postings name MCP, the protocol these roles most often secure agent-to-tool connections over.
- Introduction to Model Context Protocol Model Context Protocol, guide, free, about 1 h, introUnderstand MCP servers, clients and tools before reviewing their security boundaries.
- Security Best Practices Model Context Protocol, standard, free, about 2 h, workingThe protocol's own specification of attack vectors like token pass-through and confused deputy issues, straight from the source you would cite in a review.
- MCP Security Notification: Tool Poisoning Attacks Invariant Labs, paper, free, about 1 h, workingThe original write-up that named and demonstrated tool poisoning, showing how hidden instructions in a tool description can hijack an agent.
08Application security for LLM-backed softwareSecure SDLC and code review skills transfer directly, you are applying them to a new kind of application.
- OWASP Top 10 for LLM Applications OWASP GenAI Security Project, standard, free, about 2 h, introThe reference risk list you will map every LLM app review against, so start here.
- Guidelines for secure AI system development UK National Cyber Security Centre, guide, free, about 2 h, workingCovers secure design, build, deployment and maintenance for AI systems the way an AppSec review checklist would.
- HackAPrompt Learn Prompting, lab, free, about 3 h, introHands-on practice crafting prompt injection payloads, the equivalent of learning SQL injection by doing it.
Put it into practice
Build a small RAG or agent app, then add and test guardrails
Allow about 10 hours, plus setup. This is a practice project, not a certification or a measure of job readiness.
Build a small retrieval or agent application, break it with known attack payloads, then add input and output guardrails and show they work. Postings in this cluster ask for demonstrated ability to secure AI code; a before-and-after repo is that demonstration. Run every attack only against the app you built on your own machine. The same payloads pointed at a hosted service or an employer's system need written authorisation first.
Use fictional data and an authorised sandbox. Check model, cloud and licence costs before starting.
Project steps
- Install Python and a free local or API-based LLM (for example a small open model or a free-tier API key). The exercise assumes you can already write and run Python; if not, work the Coding skill page first.
- Build a small RAG app (load 5 to 10 text documents, embed them, answer questions from the retrieved context) or a small agent that calls 1 to 2 tools. If you would rather not start from zero, run Damn Vulnerable LLM Agent locally and treat it as your unprotected app.
- Write down 8 to 10 ways to make it misbehave: prompt injection in a document, jailbreak in user input, tool-calling abuse, data exfiltration attempts.
- Run each attack against the unprotected app and record what happens (pass or fail).
- Add input and output guardrails: input filtering, output validation, a system prompt hardened against injection, or an allowlist for tool calls.
- Re-run the same attacks against the guarded version and record the new results.
- Read the OWASP Top 10 for LLM Applications and map each of your test attacks to the OWASP category it belongs to.
- Write up the before/after results as a short report with code.
What to produce: A short repo containing the app, the attack list, before/after test results, and a written mapping to OWASP LLM Top 10 categories, something you can walk an interviewer through.
Check your work
- The app actually runs end to end without manual fixes during a demo.
- At least 8 distinct attacks were tried against the unprotected version.
- At least 3 of those attacks were blocked or changed behaviour after guardrails were added.
- Every attack in the list is mapped to an OWASP LLM Top 10 category.
- The write-up states clearly which attacks still succeed after guardrails, not just the ones that were fixed.
Career context
Security pay by experience
General security benchmarks, not an AI-security salary forecast. Skills and responsibility matter; years of experience alone do not determine pay.
United Kingdom GBP · reported annual salary
Example specialism: security engineering. These are the survey’s experience bands, not AI-security pay or job-level guarantees.
- Experience reported
1–3 years
£45,000–£59,7502026 reported salary rangeNot a zero-experience starting salary.
- Experience reported
4–6 years
£62,500–£75,7502026 reported salary range - Experience reported
7–9 years
£81,000–£98,5002026 reported salary range - Experience reported
10–12 years
£100,000–£115,7502026 reported salary range
United States USD · reported annual salary
Example specialism: security engineering. These are the survey’s experience bands, not AI-security pay or job-level guarantees.
- Experience reported
1–3 years
$59,500–$78,0002026 reported salary rangeNot a zero-experience starting salary.
- Experience reported
4–6 years
$79,750–$96,5002026 reported salary range - Experience reported
7–9 years
$106,500–$129,2502026 reported salary range - Experience reported
10–12 years
$130,500–$150,7502026 reported salary range
Reported annual salary. No bonus, equity or sales OTE added; the source does not explicitly confirm base-only pay. UK and US use separate scales and currencies; no conversion. These are snapshots across people, not a guaranteed pay progression.
Sources and methodology
Sources checked 2026-09-26. These benchmarks are separate from this guide’s small AI-security job sample. Published ranges can overlap and differ by specialism, location and employer.
United Kingdom
Cybershark Recruitment’s 2026 United Kingdom survey, Security Engineering row on page 8. Four published experience bands are reproduced directly, with no interpolation or currency conversion. The whole survey reports 3,861 respondents; counts within each role/experience band and the statistical definition of the range are not provided. Treat this as a directional recruiter benchmark, not a representative national estimate or a salary prediction. Salary and performance bonuses are reported separately, but the report does not explicitly define the table as base-only. We therefore label it reported annual salary, not verified base pay. No bonus, equity, benefits or sales OTE have been added. Zero-experience pay and AI-specific premiums are not established by this table.
- Cybershark Recruitment: United Kingdom Cyber Security Salary Survey, page 8 (PDF) (2026)
Published salary ranges for Security Engineering, by years of experience. Directly transcribed from the report’s table; no pooled job-posting ranges or invented seniority labels.
United States
Cybershark Recruitment’s 2026 United States survey, Security Engineering row on page 7. Four published experience bands are reproduced directly, with no interpolation or currency conversion. The whole survey reports 7,028 respondents; counts within each role/experience band and the statistical definition of the range are not provided. Treat this as a directional recruiter benchmark, not a representative national estimate or a salary prediction. Salary and performance bonuses are reported separately, but the report does not explicitly define the table as base-only. We therefore label it reported annual salary, not verified base pay. No bonus, equity, benefits or sales OTE have been added. Zero-experience pay and AI-specific premiums are not established by this table.
- Cybershark Recruitment: United States Cyber Security Salary Survey, page 7 (PDF) (2026)
Published salary ranges for Security Engineering, by years of experience. Directly transcribed from the report’s table; no pooled job-posting ranges or invented seniority labels.
How this sample informed the learning order
This path uses 16 postings from a 48-posting research dataset compiled on 24 September 2026, not a live vacancy feed. The counts below show how many selected postings explicitly mention each skill. They describe this sample only, not demand across the job market. The learning order also reflects prerequisites.
- LLM security: prompt injection, jailbreaks, output handling15 / 16
- Agent and agentic system security: tool use, permissions, memory, multi-agent13 / 16
- Python and coding for AI security work13 / 16
- Securing model and agent workloads on cloud platforms11 / 16
- AI system threat modelling and secure architecture10 / 16
- AI red teaming and adversarial testing7 / 16
- Model Context Protocol security: servers, tool poisoning, auth6 / 16
- Application security for LLM-backed software5 / 16
Reference frameworks for this path
- OWASP Top 10 for LLM Applications 2025
Use this as the checklist for what to test and what a guardrail should stop, prompt injection, insecure output handling, supply chain risk.
- MITRE ATLAS
Use this to name and structure the attack techniques you try against your own app, so your write-up uses recognised terminology.
- NIST AI RMF 1.0 + Generative AI Profile (AI 600-1)
Use this to frame your guardrail choices as risk controls when you explain your reasoning in an interview.