Your learning path
AI Security Researcher
Investigate how AI systems fail, test attacks and defences, and publish reproducible results.
First session
Start with one task
Choose one attack or defence paper from the skill guide. Write down the result you want to reproduce, the setup required and how you will compare outcomes.
Open the first skill guide →Use a training lab or a system you own. Testing any other system needs written permission.
What this work involves
- Design and run experiments against models to find or confirm a specific weakness.
- Write code to build test harnesses and analyse results.
- Work with LLMs directly as the object of study, sometimes extending to agent systems.
- Document the experimental setup, limitations and results so others can check them.
Learn in order
Your learning steps
Start with the first skill. Each step has a few resources here and a link to the full guide. Skip material you already know.
01AI red teaming and adversarial testingHere it means designing the attack or failure scenario you are studying, not just running a known checklist.
- MITRE ATLAS MITRE, standard, free, about 3 h, introGives you the shared vocabulary of adversary tactics and techniques against AI systems that most red team reports and tools reference.
- Gandalf Lakera, lab, free, about 2 h, introPractise prompt-injection and jailbreak attempts in an authorised challenge environment.
- Web LLM attacks PortSwigger, lab, free, about 4 h, workingFree labs that let a web app pentester practice exploiting LLM-integrated applications the same way they already practice other web vulnerabilities.
02Python and coding for AI security workYou need to build your own test scripts and harnesses, usually in Python, to run experiments repeatably.
- Hugging Face LLM Course Hugging Face, course, free, about 12 h, introLearn to use and fine-tune open models through Python examples. Basic Python knowledge is useful before starting.
- LangChain security guidance LangChain, guide, free, about 1 h, introRead the security considerations for applications that give models access to tools and data.
- Damn Vulnerable LLM Agent WithSecure Labs (now Reversec), lab, free, about 4 h, workingRun a deliberately vulnerable agent locally, inspect its code and practise finding and fixing security issues.
03LLM security: prompt injection, jailbreaks, output handlingThe model itself, its architecture and failure modes, is usually the direct subject of the research.
- OWASP Top 10 for LLM Applications OWASP GenAI Security Project, standard, free, about 3 h, introUse this list of LLM application risks to structure a review, including prompt injection and unsafe output handling.
- Prompt Injection Prevention Cheat Sheet OWASP Cheat Sheet Series, guide, free, about 1 h, workingShort, practical control checklist you can reuse directly in a design review or a client report.
- HackAPrompt Learn Prompting, lab, free, about 3 h, introA gamified prompt injection competition that builds intuition for how jailbreaks work before you move on to defending real systems.
04Agent and agentic system security: tool use, permissions, memory, multi-agentA majority of these postings extend the same research questions to agentic systems, not just single-turn model calls.
- Agentic AI: Threats and Mitigations OWASP GenAI Security Project (Agentic Security Initiative), guide, free, about 2 h, introGives you a shared vocabulary and threat model for agent-specific risks like tool misuse and excessive autonomy before you look at any single framework.
- Prompt injection (series) Simon Willison, guide, free, about 3 h, workingDocumented prompt-injection examples and commentary on how they affect applications and agents.
- AI Red Teaming, Prompt Hacking and AI Security Masterclass Learn Prompting, course, USD 1199, about 25 h, advancedA structured, hands-on path from prompt hacking basics to agent and tool-use attacks, built by the team behind the HackAPrompt competitions, if you want a paid certification track.
05AI system threat modelling and secure architectureA minority of postings need you to understand how a system is built to design a realistic experiment, even though it is not the main focus.
- NIST AI Risk Management Framework NIST, standard, free, about 3 h, workingUse its risk categories and lifecycle structure to organise an AI risk assessment.
- Guidelines for secure AI system development UK National Cyber Security Centre, guide, free, about 2 h, workingWalks through secure design, development, deployment and maintenance decisions for AI systems in plain, practitioner language.
06Securing model and agent workloads on cloud platformsNamed as a minor requirement in this small sample, mainly for running experiments at scale rather than for security operations.
- Securing generative AI: An introduction to the Generative AI Security Scoping Matrix AWS Security Blog, guide, free, about 2 h, workingGives you a working model for figuring out which security responsibilities are yours versus the provider's for any generative AI deployment.
- Azure security baseline for Azure OpenAI Microsoft Learn, guide, free, about 2 h, workingLists the specific network, identity and data controls to configure when you run a model workload on Azure.
- Google's Secure AI Framework (SAIF) Google, guide, free, about 1 h, introSets out Google's own conceptual framework for securing AI systems across the ecosystem, useful for comparing against AWS and Azure approaches.
Put it into practice
Reproduce a published attack result
Allow about 10 hours, plus setup. This is a practice project, not a certification or a measure of job readiness.
Pick one published paper describing an attack or defence against language models and reproduce its core result on a small open model you run yourself. Turning a claim in a paper into working code and an honest result is the daily work of this role.
Use fictional data and an authorised sandbox. Check model, cloud and licence costs before starting.
Project steps
- Pick one paper with a concrete, testable claim, for example a jailbreak technique, a prompt injection method, or a defence that claims to block one of those.
- Install a small open model you can run locally or cheaply, for example through Ollama, or with Hugging Face transformers on a free-tier GPU notebook such as Google Colab or Kaggle. Run the attack against a model you host yourself: check the provider's testing policy and obtain permission where required before testing a hosted API.
- Read the paper's method section twice and write down, in your own words, the exact steps needed to reproduce the result before writing any code.
- Write a script that runs the attack or defence against your model and records inputs, outputs, and whether the result matches the paper's claim.
- Run the experiment at least 10 times with varied inputs, not just the paper's exact examples, and log every failure as well as every success.
- Compare your results to the paper's reported numbers and write down where you agree, disagree, or could not tell.
- Write up the work as a short report: what you tried, what worked, what did not, and why your setup differs from the paper's.
- Publish the write-up somewhere checkable, for example a personal blog post or a public repo with the log included.
What to produce: A short written report plus the runnable code and logs, showing a real attempt to reproduce someone else's published security result on a model you controlled.
Check your work
- the code runs end to end without manual fixing when someone else tries it.
- the write-up states clearly whether the result was reproduced, partially reproduced, or not reproduced.
- at least one failed run or unexpected result is documented, not hidden.
- a reader with no context could follow the steps and get a similar result.
- the report names the model, versions, and exact prompts or inputs used.
Career context
Security pay by experience
General security benchmarks, not an AI-security salary forecast. Skills and responsibility matter; years of experience alone do not determine pay.
United Kingdom GBP · reported annual salary
Example specialism: security engineering. These are the survey’s experience bands, not AI-security pay or job-level guarantees.
- Experience reported
1–3 years
£45,000–£59,7502026 reported salary rangeNot a zero-experience starting salary.
- Experience reported
4–6 years
£62,500–£75,7502026 reported salary range - Experience reported
7–9 years
£81,000–£98,5002026 reported salary range - Experience reported
10–12 years
£100,000–£115,7502026 reported salary range
United States USD · reported annual salary
Example specialism: security engineering. These are the survey’s experience bands, not AI-security pay or job-level guarantees.
- Experience reported
1–3 years
$59,500–$78,0002026 reported salary rangeNot a zero-experience starting salary.
- Experience reported
4–6 years
$79,750–$96,5002026 reported salary range - Experience reported
7–9 years
$106,500–$129,2502026 reported salary range - Experience reported
10–12 years
$130,500–$150,7502026 reported salary range
Reported annual salary. No bonus, equity or sales OTE added; the source does not explicitly confirm base-only pay. UK and US use separate scales and currencies; no conversion. These are snapshots across people, not a guaranteed pay progression.
Sources and methodology
Sources checked 2026-09-26. These benchmarks are separate from this guide’s small AI-security job sample. Published ranges can overlap and differ by specialism, location and employer.
United Kingdom
Cybershark Recruitment’s 2026 United Kingdom survey, Security Engineering row on page 8. Four published experience bands are reproduced directly, with no interpolation or currency conversion. The whole survey reports 3,861 respondents; counts within each role/experience band and the statistical definition of the range are not provided. Treat this as a directional recruiter benchmark, not a representative national estimate or a salary prediction. Salary and performance bonuses are reported separately, but the report does not explicitly define the table as base-only. We therefore label it reported annual salary, not verified base pay. No bonus, equity, benefits or sales OTE have been added. Zero-experience pay and AI-specific premiums are not established by this table.
- Cybershark Recruitment: United Kingdom Cyber Security Salary Survey, page 8 (PDF) (2026)
Published salary ranges for Security Engineering, by years of experience. Directly transcribed from the report’s table; no pooled job-posting ranges or invented seniority labels.
United States
Cybershark Recruitment’s 2026 United States survey, Security Engineering row on page 7. Four published experience bands are reproduced directly, with no interpolation or currency conversion. The whole survey reports 7,028 respondents; counts within each role/experience band and the statistical definition of the range are not provided. Treat this as a directional recruiter benchmark, not a representative national estimate or a salary prediction. Salary and performance bonuses are reported separately, but the report does not explicitly define the table as base-only. We therefore label it reported annual salary, not verified base pay. No bonus, equity, benefits or sales OTE have been added. Zero-experience pay and AI-specific premiums are not established by this table.
- Cybershark Recruitment: United States Cyber Security Salary Survey, page 7 (PDF) (2026)
Published salary ranges for Security Engineering, by years of experience. Directly transcribed from the report’s table; no pooled job-posting ranges or invented seniority labels.
How this sample informed the learning order
This path uses 4 postings from a 48-posting research dataset compiled on 24 September 2026, not a live vacancy feed. The counts below show how many selected postings explicitly mention each skill. They describe this sample only, not demand across the job market. The learning order also reflects prerequisites.
- AI red teaming and adversarial testing4 / 4
- Python and coding for AI security work4 / 4
- LLM security: prompt injection, jailbreaks, output handling4 / 4
- Agent and agentic system security: tool use, permissions, memory, multi-agent3 / 4
- AI system threat modelling and secure architecture1 / 4
- Securing model and agent workloads on cloud platforms1 / 4
Reference frameworks for this path
- OWASP Top 10 for LLM Applications 2025
Gives a shared vocabulary for the kind of failure you are studying, useful when framing your write-up for a non-research reader.
- MITRE ATLAS
Helps position a single reproduced attack within a broader catalogue of known adversarial techniques against AI systems.