AI Security Engineer Career Guide: Skills and Routes

Organisations are shipping LLM applications, retrieval pipelines and AI agents faster than they can find people who know how to secure them. The AI security engineer is the role that fills that gap: part application security engineer, part cloud and identity engineer, with enough machine learning knowledge to reason about how models fail. The job title is new and the boundaries are still moving, so there is no single accepted definition or official workforce code for it yet. This guide sets out what the role does in practice, the skills and frameworks it draws on, realistic routes in, the certifications that help, and how the career develops. It is written for security engineers, developers and ML engineers considering the move, and for managers defining the role.

Key takeaways

It is a security engineering role first. Most of the work is application, API, cloud and identity security applied to systems that happen to contain models, plus a smaller set of AI-specific threats.
No official work role exists yet. The NICE Framework components (v2.2.0) have no AI security work role, so employers borrow from software security assessment, security architecture and data science roles.
Know the AI threat catalogues cold. OWASP Top 10 for LLM Applications 2025, MITRE ATLAS and NIST AI 100-2 E2025 are the shared vocabulary for prompt injection, poisoning, extraction and excessive agency.
Agents turn model bugs into identity incidents. When an agent holds API keys, OAuth tokens and tool access, a successful prompt injection becomes an access control failure, so non-human identity skills are central.
Evidence beats credentials. AI-specific certifications are young; red-team write-ups, threat models of real LLM features and contributions to open projects carry more weight with hiring panels.

What the role does

An AI security engineer protects systems that build, host or call machine learning models, with most current demand centred on generative AI: chat assistants, retrieval-augmented generation (RAG), coding assistants and autonomous agents that call tools. NIST describes the attack surface in NIST AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (March 2025), which covers poisoning, evasion, privacy attacks and abuse across predictive and generative systems. Because the NICE Framework has no dedicated AI security work role, job descriptions usually combine tasks from Software Security Assessment (DD-WRL-005), such as performing code reviews (T1073) and developing threat models (T1106), with architecture and cloud work.

Variant	Typical employer	Main focus
AI application security engineer	Enterprises building LLM features	Design reviews, threat models, guardrails, secure integration of model APIs and RAG data
AI red team engineer	Model providers, large enterprises, consultancies	Adversarial testing of models and agents, jailbreak and prompt injection testing, reporting
AI platform or MLOps security engineer	Organisations training or hosting models	Model supply chain, training data integrity, GPU cluster and pipeline security, model registry access
AI governance engineer	Regulated sectors	Turning AI policy, risk assessments and regulatory duties into technical controls and evidence

Typical weekly work includes:

Design and threat model reviews: examining new AI features for prompt injection paths, data leakage through retrieval, over-broad tool permissions and unsafe output handling. See the AI Agent Threat Modelling Guide.
Adversarial testing: building test suites and running red-team exercises against models and agents before and after release. See the AI Red Teaming Guide.
Guardrail and gateway engineering: input and output filtering, rate limits, content policies and logging, often centralised in an AI gateway. See the AI Gateway and LLM Gateway Guide.
Credential and access design for AI workloads: scoping model API keys, agent tokens and connector permissions, and preventing stolen keys being resold for model access. The LLMjacking cases from 2024 to 2026 show what happens when cloud credentials and API keys leak.
Model and dependency supply chain: vetting model files, packages and datasets, and controlling who can publish to model registries.
Monitoring and incident response: defining what to log for prompts, tool calls and retrievals, and handling AI-specific incidents. See the LLM Observability Guide.

Core skills and tools

AI threat knowledge

Threat	OWASP LLM Top 10 2025	MITRE ATLAS	What the engineer must be able to do
Prompt injection, direct and indirect	LLM01 Prompt Injection	AML.T0051 LLM Prompt Injection	Trace untrusted content into the context window and limit what injected instructions can trigger
Sensitive data leakage	LLM02 Sensitive Information Disclosure; LLM07 System Prompt Leakage	AML.T0024 Exfiltration via AI Inference API	Enforce access control on retrieved data, keep secrets out of prompts
Model and data supply chain	LLM03 Supply Chain; LLM04 Data and Model Poisoning	AML.T0010 AI Supply Chain Compromise; AML.T0020 Poison Training Data	Verify provenance of models, datasets and packages; control training pipelines
Unsafe output use	LLM05 Improper Output Handling	AML.T0043 Craft Adversarial Data	Treat model output as untrusted input to downstream systems
Over-privileged agents	LLM06 Excessive Agency	AML.T0051 (as the usual trigger)	Design least-privilege tools, human approval for high-impact actions, scoped credentials
RAG weaknesses	LLM08 Vector and Embedding Weaknesses	(no single technique)	Segregate vector stores by tenant and permission, validate ingested documents
Cost and availability abuse	LLM10 Unbounded Consumption	(no single technique)	Quotas, rate limits and spend alerts per identity

The EchoLeak case against Microsoft 365 Copilot (2025) is a useful study of indirect prompt injection combined with data access, and the LiteLLM PyPI package breach (2026) shows how AI tooling inherits ordinary package supply chain risk. See the OWASP Top 10 for LLM Applications Guide, the MITRE ATLAS Guide and the Prompt Injection Guide.

Foundation skills

Application and API security: authentication, authorisation, input handling and secure SDLC practice. NIST SP 800-218 (SSDF v1.1) is the baseline, with SP 800-218A published as a companion part.
Cloud and identity: IAM policy design, workload identity federation, secrets management and logging on at least one major cloud, since most models are consumed as cloud services.
Machine learning literacy: enough to understand training, fine-tuning, embeddings, inference and evaluation. Python is the working language of the field.
Testing and automation: writing evaluation harnesses and regression tests for model behaviour, and wiring them into CI/CD.
Risk and governance: reading the NIST AI RMF 1.0 (January 2023) and its four functions, Govern, Map, Measure and Manage, plus the Generative AI Profile, NIST AI 600-1 (July 2024). See the NIST AI RMF Guide and the ISO/IEC 42001 Guide.
Communication: explaining probabilistic risks to product teams who expect a binary pass or fail.

Tool categories

Adversarial testing harnesses: open-source and commercial tools that generate jailbreak and injection attempts and score responses.
Guardrails and AI gateways: policy layers that filter prompts and outputs, enforce quotas and log every call.
Model and dependency scanners: tools that inspect model files for unsafe serialisation and check package provenance.
AI security posture management: inventory of models, endpoints, agents and their permissions. See the AI Security Posture Management (AI-SPM) Guide.

Routes into the role

Starting point	Strength it brings	Gap to close
Application security engineer	Threat modelling, code review, SDLC integration	ML concepts, model behaviour testing, agent design
Penetration tester or red teamer	Adversarial mindset, reporting	Evaluation methods, statistics of non-deterministic results, defensive engineering
Cloud or IAM engineer	Credential, workload identity and logging design	AI threat catalogues, model supply chain
ML or data engineer	Deep understanding of training and inference	Security fundamentals, threat modelling, incident handling
Software developer building LLM features	Hands-on knowledge of RAG and agent frameworks	Security testing, risk language, governance

Pick your anchor: decide whether you come from the security side or the ML side, and plan the opposite half deliberately.
Learn the catalogues: read the OWASP Top 10 for LLM Applications 2025, browse MITRE ATLAS techniques and case studies, and work through NIST AI 100-2 E2025. The OWASP AI Exchange adds more than 300 pages of free guidance on threats, controls and testing.
Build and break something: create a small RAG application and an agent with two or three tools, then attack them yourself. Document the threat model, the attacks that worked and the fixes.
Volunteer internally: ask to review the next AI feature in your organisation, or join its AI governance working group.
Publish evidence: write-ups of test findings (sanitised), talks, or contributions to OWASP AI projects carry weight because the field is short of verifiable experience.
Apply for hybrid roles first: application security or cloud security posts with an AI focus are more common than pure AI security titles.

In a small organisation the AI security engineer is often the application security lead who also covers AI features, so breadth matters most. Large enterprises and model providers split the work across red teams, platform security and governance functions. See the Cybersecurity Careers Guide and the Security Architect Career Guide.

Certifications that help

Checked on the certifying bodies' sites on 24 October 2026. AI credentials are new and change quickly, so confirm details with the awarding body before planning around them.

Certification	Body	What it shows	Notes from the official page
AAISM (Advanced in AI Security Management)	ISACA	AI security management for experienced security managers	Requires an active CISM or CISSP; covers AI Governance and Program Management, AI Technologies and Controls, and AI Risk Management
GMLE (GIAC Machine Learning Engineer)	GIAC	Applied machine learning skills for security work	82 questions, 3 hours, 65% pass mark; Python, supervised and unsupervised learning, deep learning
AIGP (Artificial Intelligence Governance Professional)	IAPP	AI governance, law and responsible AI	Suits governance-leaning roles more than hands-on engineering
CSSLP	ISC2	Secure software lifecycle knowledge	Four years' work experience required; ANAB accredited under ISO/IEC 17024
CISSP or CISM	ISC2; ISACA	Broad security management	Prerequisite for AAISM; useful for senior and lead roles
ISO/IEC 42001 Lead Implementer or Lead Auditor	Various accredited training bodies	AI management system implementation and audit	Relevant to AI governance engineering

See the ISACA AAISM and AAIA AI Certifications Guide, the CISSP Certification Guide, the CISM Certification Guide, the ISO 42001 Lead Auditor and Lead Implementer Guide and the Cybersecurity Certifications Guide.

Choosing: an engineer early in the move gets more from a portfolio and an applied ML certification such as GMLE than from a management credential. A security manager who already holds CISM or CISSP and owns AI risk is the intended audience for AAISM. Governance-heavy roles in regulated sectors benefit from AIGP or ISO/IEC 42001 training.

Progression

Level	Focus	Signs you are ready for the next step
Security engineer with AI scope	Reviews and tests individual AI features under guidance	Runs threat models alone, findings accepted by product teams
AI security engineer	Owns security of a product line or platform, builds test suites and guardrails	Patterns you wrote are reused by other teams
Senior or lead AI security engineer	Sets AI security standards, leads red-team programmes, handles AI incidents	Influences architecture and governance decisions across the organisation
Principal engineer, AI security architect or head of AI security	Strategy, reference architectures, regulatory alignment, team leadership	Board and regulator-facing work

Pay is not given here because no official statistics source publishes a separate figure for AI security engineers. For context, the US Bureau of Labor Statistics reports a median annual wage of $129,180 in May 2025 for the broader information security analyst occupation, with employment projected to grow 21% from 2025 to 2035. See the AI Security Architecture Reference Guide for the design side of senior roles.

Where identity fits

An AI agent acts through credentials: model provider API keys, OAuth tokens for connected SaaS, cloud workload identities and MCP server connections. If an injected instruction can reach a tool, the blast radius equals that tool's permissions. AI security engineers therefore need to design short-lived, narrowly scoped credentials per agent, separate identities for each tool connection, human approval for high-impact actions, and full logging of every tool call against the identity that made it. See the Zero Trust for AI Agents Guide, the MCP Security Guide and the LLMjacking Guide.

Measuring your effectiveness

Review coverage: percentage of AI features and agents that had a threat model and security review before release.
Adversarial test coverage: share of production AI applications with an automated injection and jailbreak regression suite in CI/CD.
Credential hygiene: number of long-lived model API keys and agent tokens, and the median credential lifetime.
Inventory completeness: models, endpoints and agents discovered by posture tooling that were not in the official register.
Time to contain: hours from detection of an AI misuse event to revocation of the credentials involved.

Framework mapping

Framework	Reference	Relevance to the role
NICE Framework	DD-WRL-005 Software Security Assessment (closest existing role)	Code review, threat modelling and security testing tasks
NIST AI RMF 1.0 and AI 600-1	Govern, Map, Measure, Manage	Risk language for AI systems and generative AI
NIST CSF 2.0	GV.RR-02, ID.AM-08, ID.RA-01	Defined roles, life cycle management of AI systems, vulnerability identification
NIST SP 800-53 Rev. 5	SA-8, SA-11, SR-3	Engineering principles, developer testing, supply chain controls
MITRE ATLAS	AML.T0051, AML.T0020, AML.T0010	Adversary techniques against AI systems
OWASP	Top 10 for LLM Applications 2025; AI Exchange	Threat and control catalogues used in reviews

Common failure patterns

Treating it as prompt filtering only: engineers who rely on input filters miss output handling, retrieval permissions and tool scoping, which is where most real damage occurs.
Ignoring conventional security: leaked API keys, exposed model endpoints and vulnerable packages cause more AI incidents than exotic model attacks.
One-off red teaming: model updates and prompt changes alter behaviour, so tests that are not automated and repeated go stale quickly.
No ownership for agent credentials: agents built in pilots keep broad, long-lived tokens after they move to production.
Learning ML without security depth: candidates who know model internals but cannot threat model a web application struggle in interviews and in the job.

Practitioner checklist

Read the OWASP Top 10 for LLM Applications 2025 and map each item to a control you could implement.
Work through NIST AI 100-2 E2025 and the MITRE ATLAS case studies.
Build a small RAG app and agent, threat model it, attack it and document the fixes.
Get working depth in one cloud's IAM, workload identity and secrets management.
Write an automated prompt injection regression suite and run it in CI.
Learn the NIST AI RMF functions and how your organisation records AI risk.
Choose one certification that matches your stage: GMLE for applied ML, AAISM once you hold CISM or CISSP.
Publish one sanitised write-up or talk on an AI security finding.

AI Security Engineer Career Guide: Skills, Roles and How to Get Started