Careers in AI security
AI security is growing, and there are many ways in. Learn the main roles, the skills to build, and how to show your work safely and ethically.
In 60 seconds
Careers in AI security
AI security is growing, and there are many ways in. Learn the main roles, the skills to build, and how to show your work safely and ethically.
Roles to know
| Role | What they do | Good starting skills |
|---|---|---|
| SOC analyst using AI | Triage alerts and investigate incidents with AI helpers | Networking, operating systems, log analysis, clear writing |
| Detection engineer | Build and test detection rules, often as code | Query languages, scripting, ATT&CK, testing habits |
| AppSec engineer with AI | Review code, run scanners, use AI in secure development | Programming, web security basics, code review |
| AI security engineer | Secure AI applications and agents: permissions, data, monitoring | Cloud, identity, application security, how LLMs work |
| AI red teamer | Test AI systems for weaknesses, with permission | Prompt injection, threat modelling, tools like garak, PyRIT or promptfoo |
| GRC for AI | Governance, risk and compliance for AI use | Risk frameworks like NIST AI RMF, ISO/IEC 42001, policy writing |
Skills to build
- Networking and operating system basics: how TCP/IP, DNS, HTTP, Windows and Linux work.
- Scripting: Python or PowerShell to automate small tasks and parse logs.
- Cloud: identities, permissions and logging in at least one major cloud.
- LLM basics: tokens, context, tools, agents, and how they fail.
- Threat modelling: thinking about what could go wrong, for example with STRIDE.
- Communication: writing clear reports for both engineers and managers.
Build a portfolio
- 1
Home lab
Set up a few virtual machines and a free log tool on your own computer. Write up what you built. - 2
CTFs
Join legal capture-the-flag competitions and write up how you solved challenges (after they end). - 3
Detections
Write and test Sigma or YARA rules on sample data, and share them with notes. - 4
Open source
Improve documentation, tests or rules in security projects you use. - 5
Write-ups
Blog about what you learned, including mistakes. Clear writing is a key skill.
Certifications
Ethics
- Screenshots of scans on websites you had no permission to test
- Copied write-ups with no personal work
- Real client logs used as examples
- Home lab write-ups with your own reasoning
- Tested rules with sample data and notes
- Made-up or public practice data only
Watch and read more
Lab
A 3-month learning plan and one portfolio project idea for your chosen role.
The problem
Plan your next steps into AI security.
- Choose one role from this lesson and write why it suits you.
- List the skills it needs. Mark each: have, learning, not started.
- Write a 3-month plan with one small goal per two weeks.
- Describe one portfolio project that uses only your own lab or made-up data, and how you will write it up.
- Write two ethical rules you will follow in all your practice.
You are done when
Hard questions
Try to answer before you reveal. If you can answer these, you understood the lesson.
Q1Why do communication skills matter so much in AI security roles?Reveal
Security findings only help if people act on them. You need to explain risks to developers, managers and sometimes customers, often in simple language. With AI, you also have to explain its limits honestly, so leaders neither ignore it nor trust it too much.
Q2A friend asks you to "quickly test" their employer's chatbot for prompt injection to build your portfolio. What do you do?Reveal
Decline unless the employer gives written permission and clear scope. Your friend cannot authorise testing of a system they do not own. Instead, build your own small chatbot app, or use deliberately vulnerable practice labs, and test those. Your portfolio should show good judgement as well as skill.
Questions people ask
Do I need a computer science degree?
It helps, but many people enter security from IT support, networking, software development or other fields. Employers look for real skills, curiosity, and clear communication. A good portfolio can show these.
Should I learn AI or security first?
Build strong security basics first (networking, systems, logs), and learn LLM basics alongside. Most AI security work is still security work, applied to a new kind of system.
Is it too late to enter security because AI will do the work?
AI changes the tasks, but organisations still need people to investigate, decide, build detections and secure AI systems themselves. People who understand both security and AI are in a good position.
Are CTF write-ups allowed?
Usually yes, after the competition ends, and following the organisers' rules. Check the rules before publishing.
Lesson test
5 questions. Get 3 right (60%) to pass and complete this lesson.