Your learning path
AI Red Teamer
Test AI applications for prompt injection, data leaks and unsafe tool use. Write findings that an engineering team can reproduce and fix.
First session
Start with one task
Try one PortSwigger Web LLM attacks lab. Record the input, the response and the security impact, then explain how you would prevent it.
Open the first skill guide →Use a training lab or a system you own. Testing any other system needs written permission.
What this work involves
- Define a test scope and run repeatable attacks against an authorised AI application.
- Write scripts that rerun tests when the model, prompt or tools change.
- Test whether prompts or retrieved content can expose data or trigger unauthorised actions.
- Report the impact, reproduction steps and proposed fixes; retest after changes.
Learn in order
Your learning steps
Start with the first skill. Each step has a few resources here and a link to the full guide. Skip material you already know.
01AI red teaming and adversarial testingPlan repeatable tests and document the findings.
- MITRE ATLAS MITRE, standard, free, about 3 h, introGives you the shared vocabulary of adversary tactics and techniques against AI systems that most red team reports and tools reference.
- Gandalf Lakera, lab, free, about 2 h, introPractise prompt-injection and jailbreak attempts in an authorised challenge environment.
- Web LLM attacks PortSwigger, lab, free, about 4 h, workingFree labs that let a web app pentester practice exploiting LLM-integrated applications the same way they already practice other web vulnerabilities.
02Python and coding for AI security workScript attacks and capture results so another person can reproduce the test.
- Hugging Face LLM Course Hugging Face, course, free, about 12 h, introLearn to use and fine-tune open models through Python examples. Basic Python knowledge is useful before starting.
- LangChain security guidance LangChain, guide, free, about 1 h, introRead the security considerations for applications that give models access to tools and data.
- Damn Vulnerable LLM Agent WithSecure Labs (now Reversec), lab, free, about 4 h, workingRun a deliberately vulnerable agent locally, inspect its code and practise finding and fixing security issues.
03LLM security: prompt injection, jailbreaks, output handlingUnderstand how instructions and untrusted input interact.
- OWASP Top 10 for LLM Applications OWASP GenAI Security Project, standard, free, about 3 h, introUse this list of LLM application risks to structure a review, including prompt injection and unsafe output handling.
- Prompt Injection Prevention Cheat Sheet OWASP Cheat Sheet Series, guide, free, about 1 h, workingShort, practical control checklist you can reuse directly in a design review or a client report.
- HackAPrompt Learn Prompting, lab, free, about 3 h, introA gamified prompt injection competition that builds intuition for how jailbreaks work before you move on to defending real systems.
04Agent and agentic system security: tool use, permissions, memory, multi-agentTest tool permissions and the actions an agent can take.
- Agentic AI: Threats and Mitigations OWASP GenAI Security Project (Agentic Security Initiative), guide, free, about 2 h, introGives you a shared vocabulary and threat model for agent-specific risks like tool misuse and excessive autonomy before you look at any single framework.
- Prompt injection (series) Simon Willison, guide, free, about 3 h, workingDocumented prompt-injection examples and commentary on how they affect applications and agents.
- AI Red Teaming, Prompt Hacking and AI Security Masterclass Learn Prompting, course, USD 1199, about 25 h, advancedA structured, hands-on path from prompt hacking basics to agent and tool-use attacks, built by the team behind the HackAPrompt competitions, if you want a paid certification track.
05Securing model and agent workloads on cloud platformsCheck the surrounding identity, network and data controls.
- Securing generative AI: An introduction to the Generative AI Security Scoping Matrix AWS Security Blog, guide, free, about 2 h, workingGives you a working model for figuring out which security responsibilities are yours versus the provider's for any generative AI deployment.
- Azure security baseline for Azure OpenAI Microsoft Learn, guide, free, about 2 h, workingLists the specific network, identity and data controls to configure when you run a model workload on Azure.
- Google's Secure AI Framework (SAIF) Google, guide, free, about 1 h, introSets out Google's own conceptual framework for securing AI systems across the ecosystem, useful for comparing against AWS and Azure approaches.
06Application security for LLM-backed softwareUse web and API testing skills alongside model-specific tests.
- Guidelines for secure AI system development UK National Cyber Security Centre, guide, free, about 2 h, workingCovers secure design, build, deployment and maintenance for AI systems the way an AppSec review checklist would.
- SEC545: GenAI and LLM Application Security SANS Institute, course, USD 8000, about 36 h, advancedA dedicated instructor-led course and GIAC cert for AppSec engineers whose job becomes securing LLM applications full time.
07AI system threat modelling and secure architectureMap trust boundaries to decide where to test.
- OWASP Top 10 for LLM Applications OWASP GenAI Security Project, guide, free, about 2 h, introUse the risk categories as prompts when reviewing an LLM application design.
- MITRE ATLAS MITRE, guide, free, about 3 h, workingGives you a tactics and techniques matrix for adversarial ML attacks that you can use directly in threat modelling sessions.
- NIST AI Risk Management Framework NIST, standard, free, about 3 h, workingUse its risk categories and lifecycle structure to organise an AI risk assessment.
08RAG pipeline security: retrieval, vector stores, data poisoningTest whether retrieved content can change behaviour or expose data.
- OWASP Top 10 for LLM Applications OWASP GenAI Security Project, standard, free, about 3 h, introCovers vector and embedding weaknesses and supply chain risk, which is the standard vocabulary for talking about RAG-specific threats.
- PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation arXiv, paper, free, about 2 h, advancedA research paper on injecting malicious documents into a knowledge base to influence the answers a RAG system produces.
- garak: LLM vulnerability scanner NVIDIA, tool, free, about 2 h, workingLets you probe a deployed LLM or RAG-backed app for data leakage and injection issues instead of only reasoning about it on paper.
Put it into practice
Test a deliberately vulnerable AI app
Allow about 10 hours, plus setup. This is a practice project, not a certification or a measure of job readiness.
Run a local training app such as Damn Vulnerable LLM Agent. Define the scope, run a documented set of attacks and write up the findings with reproduction steps and suggested fixes. Use only your own app or a lab that explicitly permits testing.
Use fictional data and an authorised sandbox. Check model, cloud and licence costs before starting.
Project steps
- Install Python and a free local or API-based LLM, then get a deliberately unguarded target: build a small chat or agent app with no filtering and no hardened system prompt, or run Damn Vulnerable LLM Agent locally.
- Warm up on a public challenge set (Gandalf, HackAPrompt or the PortSwigger Web LLM attack labs) and keep notes on what worked and why.
- Write a short test plan: list 10 to 15 attack cases across categories such as prompt injection, jailbreak, data exfiltration and tool misuse, each with a pass/fail criterion.
- Run every test case against the weak app and record the actual result for each one.
- For each successful attack, capture the exact input, the model's response, and the impact if this were a real deployment.
- Write findings in pentest report format: summary, per-finding impact, reproduction steps, suggested fix.
- Propose one guardrail or mitigation per finding and note, without implementing it, what should change.
- Review the report as if you were the person reading it cold, check every finding has enough detail to reproduce.
What to produce: A written test plan plus a pentest-style findings report (summary, impact, reproduction steps, fix per finding) against your own deliberately weak app, ready to show in an interview.
Check your work
- The test plan has at least 10 distinct attack cases with a stated pass/fail criterion for each.
- Every test case was actually run against the app, not assumed.
- Every successful attack has a documented reproduction step someone else could follow.
- Every finding states an impact and a suggested fix, not just the payload.
- The report is understandable to someone who has not seen the app before.
Career context
Security pay by experience
General security benchmarks, not an AI-security salary forecast. Skills and responsibility matter; years of experience alone do not determine pay.
United Kingdom GBP · reported annual salary
Example specialism: security engineering. These are the survey’s experience bands, not AI-security pay or job-level guarantees.
- Experience reported
1–3 years
£45,000–£59,7502026 reported salary rangeNot a zero-experience starting salary.
- Experience reported
4–6 years
£62,500–£75,7502026 reported salary range - Experience reported
7–9 years
£81,000–£98,5002026 reported salary range - Experience reported
10–12 years
£100,000–£115,7502026 reported salary range
United States USD · reported annual salary
Example specialism: security engineering. These are the survey’s experience bands, not AI-security pay or job-level guarantees.
- Experience reported
1–3 years
$59,500–$78,0002026 reported salary rangeNot a zero-experience starting salary.
- Experience reported
4–6 years
$79,750–$96,5002026 reported salary range - Experience reported
7–9 years
$106,500–$129,2502026 reported salary range - Experience reported
10–12 years
$130,500–$150,7502026 reported salary range
Reported annual salary. No bonus, equity or sales OTE added; the source does not explicitly confirm base-only pay. UK and US use separate scales and currencies; no conversion. These are snapshots across people, not a guaranteed pay progression.
Sources and methodology
Sources checked 2026-09-26. These benchmarks are separate from this guide’s small AI-security job sample. Published ranges can overlap and differ by specialism, location and employer.
United Kingdom
Cybershark Recruitment’s 2026 United Kingdom survey, Security Engineering row on page 8. Four published experience bands are reproduced directly, with no interpolation or currency conversion. The whole survey reports 3,861 respondents; counts within each role/experience band and the statistical definition of the range are not provided. Treat this as a directional recruiter benchmark, not a representative national estimate or a salary prediction. Salary and performance bonuses are reported separately, but the report does not explicitly define the table as base-only. We therefore label it reported annual salary, not verified base pay. No bonus, equity, benefits or sales OTE have been added. Zero-experience pay and AI-specific premiums are not established by this table.
- Cybershark Recruitment: United Kingdom Cyber Security Salary Survey, page 8 (PDF) (2026)
Published salary ranges for Security Engineering, by years of experience. Directly transcribed from the report’s table; no pooled job-posting ranges or invented seniority labels.
United States
Cybershark Recruitment’s 2026 United States survey, Security Engineering row on page 7. Four published experience bands are reproduced directly, with no interpolation or currency conversion. The whole survey reports 7,028 respondents; counts within each role/experience band and the statistical definition of the range are not provided. Treat this as a directional recruiter benchmark, not a representative national estimate or a salary prediction. Salary and performance bonuses are reported separately, but the report does not explicitly define the table as base-only. We therefore label it reported annual salary, not verified base pay. No bonus, equity, benefits or sales OTE have been added. Zero-experience pay and AI-specific premiums are not established by this table.
- Cybershark Recruitment: United States Cyber Security Salary Survey, page 7 (PDF) (2026)
Published salary ranges for Security Engineering, by years of experience. Directly transcribed from the report’s table; no pooled job-posting ranges or invented seniority labels.
How this sample informed the learning order
This path uses 9 postings from a 48-posting research dataset compiled on 24 September 2026, not a live vacancy feed. The counts below show how many selected postings explicitly mention each skill. They describe this sample only, not demand across the job market. The learning order also reflects prerequisites.
- AI red teaming and adversarial testing9 / 9
- Python and coding for AI security work8 / 9
- LLM security: prompt injection, jailbreaks, output handling7 / 9
- Agent and agentic system security: tool use, permissions, memory, multi-agent7 / 9
- Securing model and agent workloads on cloud platforms4 / 9
- Application security for LLM-backed software2 / 9
- AI system threat modelling and secure architecture2 / 9
- RAG pipeline security: retrieval, vector stores, data poisoning1 / 9
Reference frameworks for this path
- OWASP Top 10 for LLM Applications 2025
Use this to structure your test plan categories so attacks map to recognised risk types.
- MITRE ATLAS
Use its tactics and techniques as the taxonomy for naming and organising your attack cases in the report.
- NCSC Guidelines for secure AI system development
Use this to frame your suggested fixes as recognised secure-development practice rather than ad hoc advice.