The Sec Guy
Open Menu

Notes · AI security · Career · Roadmap

How to become an AI security engineer: a 6-step roadmap

The path from security or cloud engineer to AI security engineer: what to learn in what order, free labs and official resources for each step, and how to show proof.

22 October 2026 · 9 min read

Short answer

Start with normal security and one cloud, because most AI security work is still identity, data and network control. Then learn how LLM apps, RAG and agents are wired, practise the attacks in the OWASP Top 10 for LLM Applications, and learn your cloud's AI guardrails. Finish with detection, governance and three small public projects. A certificate helps after that, not before.

An AI security engineer makes sure the AI a company ships can’t be turned against it: chatbots that leak data, agents that run an attacker’s commands, models pulled from an untrusted source. The fastest route in is from a job you already have (cloud security, AppSec, SOC, development or GRC), because about half of the work is security you already know, applied to a new kind of system.

The field is young. The term prompt injection was coined in September 2022 (Simon Willison) and the first OWASP Top 10 for LLM applications came out in 2023 (OWASP). Nobody has ten years of this. You can catch up.

Step What you’ll be able to do Proof you’ll have
1. Security + one cloud Explain identity, network paths and logging in one cloud Notes and a hardened lab account
2. How AI apps work Draw an LLM app with RAG and tools, and mark where data flows One diagram you can explain in 2 minutes
3. Attack and defend Run prompt injection and data-leak attacks, then fix them Write-ups of labs you finished
4. AI in your cloud Lock down a managed model service and its guardrails Infrastructure code for one secured AI workload
5. Detect and govern Spot AI abuse in logs and map controls to a framework One detection rule and a one-page control map
6. Prove it Show working projects, then certify 3 public projects, then one exam

Step 1: Security basics and one cloud

Why first: an AI agent is a new kind of identity with tools and data access. If you can’t reason about IAM, network reach and logs, you can’t secure it. Many of the real agent hijacks researchers have shown ended the same way: a token with too much access, or data sent somewhere it shouldn’t go.

Do this: follow steps 1 to 3 of our cloud security roadmap: one cloud deep (identity, networking, logging), how real breaches happen, and enough Python and Terraform to automate a check. Already a cloud or AppSec engineer? Skip to step 2.

Step 2: Learn how AI apps are wired

You don’t need to train models or learn the maths. You need to know the parts an attacker touches:

  • Prompts and context: the model reads system instructions, user input and retrieved text as one stream of text. It can’t reliably tell instructions from data.
  • RAG (retrieval-augmented generation): the app searches your documents and pastes the results into the prompt. Whoever can write to those documents can talk to the model.
  • Tools and agents: the model can call APIs, run code or send email with the app’s credentials.
  • MCP servers: a standard way to plug tools into agents, and a new supply-chain risk. Read the MCP security best practices.

Free start: our lesson It’s OK not to know this yet shows how SOC, cloud, AppSec, dev and GRC skills map onto this.

Step 3: Attack and defend AI apps

This is the core of the job. Learn the shared vocabulary, then break things in safe labs.

The defences to know cold: treat everything a model reads as untrusted, give agents the least access possible with short-lived tokens, require human approval for risky actions, and block the ways data can leave. Our note on 6 real AI agent hijacks walks through all of them with real cases.

Step 4: Secure AI in your cloud

Each cloud has a managed model service and its own guardrails. Learn the one you use at work.

Guardrails are one layer, not the fix. They sit on top of the identity, network and logging controls from step 1: private endpoints, scoped roles for the app, and logs of every model call.

Step 5: Detect, respond and govern

  • Detection: know what normal model use looks like for your app, then alert on the unusual: a spike in tokens, calls from a new identity, a tool used for the first time.
  • Governance: governance and risk teams will speak in frameworks. Learn enough to map your technical controls to them: the NIST AI Risk Management Framework (released January 2023), its Generative AI Profile, NIST AI 600-1, ISO/IEC 42001 (AI management systems) and, if you serve EU customers, the EU AI Act.

Step 6: Build proof, then certify

Three small public projects beat a long list of courses:

  1. Break and fix a RAG app. Plant an instruction in a document, show the leak, then show the fix and a test that proves it.
  2. Lock down an agent. Give an agent one tool, then cut its permissions to the minimum and log every call.
  3. A detection. One alert rule for AI abuse in your cloud’s logs, with a short write-up of what it catches and what it misses.

Then, if you want a credential, pick one that matches your job. Our comparison of AI security certifications in 2026 covers ISACA AAISM, CompTIA SecAI+, GIAC GAIPS, IAPP AIGP, the practical exams and the cloud exams that now include AI.

Want it structured?

Everything above is free to learn on your own. If you’d rather follow one path with labs that run free on your laptop first, then in AWS, Azure or Google Cloud, that’s what our course AI Security Engineer is. It ends in a certificate of completion, not an industry certification. See the full curriculum.

Sources

All links checked 22 October 2026.