Build a normal security or software foundation first, then learn how LLM apps fail using the OWASP Top 10 for LLM Applications and MITRE ATLAS, and prove it by building, testing and hardening a small LLM app of your own. Most people reach AI security through AppSec, security engineering or ML engineering, not straight from university.
What people tell me
I keep hearing that AI security is the next big thing and I want to get into it early. I know some Python and have built a couple of small projects with LLM APIs, but I have never worked in security. Every roadmap I find is either a list of jailbreak tricks or a wall of frameworks. I do not know whether I should learn traditional security first, study machine learning, or jump straight into prompt injection, and I am not sure what kind of job to aim for.
A composite of the messages behind this question, with personal details left out.
Key takeaways
- AI security is mostly application security, data protection and least privilege applied to LLM apps and agents.
- Learn the foundations first: web security, authentication, the OWASP Top 10, and enough machine learning to understand training, inference and retrieval.
- Use the OWASP Top 10 for LLM Applications and MITRE ATLAS as your maps, and learn each risk with its defence.
- Build a small LLM app of your own, test it with tools like promptfoo or garak, fix what you find and publish the write-up.
- Aim for AppSec, security engineering or ML engineering roles where you become the person trusted with AI risks.
The honest picture
AI security is real and growing, but it is still a young field. Very few companies hire someone as a "junior AI security engineer". The work usually sits inside application security, product security, security engineering or ML platform teams, and the people doing it mostly came from one of those backgrounds. So the fastest route in is not to skip the fundamentals. It is to get the fundamentals, then become visibly good at the AI part.
The good news is that most AI security problems are old problems in a new place. An LLM app that shows model output as raw HTML has an XSS problem. An agent with an admin key has a least privilege problem. A retrieval system that returns another customer's documents has an access control problem. If you understand those well, you are already halfway there.
Step 1: build a security foundation
Learn the CIA triad, authentication and authorisation, hashing and encryption at a conceptual level, and the OWASP Top 10 for web applications from the builder's side. Set up a small, safe home lab. The cybersecurity roadmap covers all of this in its shared stages; pick the AI security path when you start it.
Step 2: learn how LLM apps work and fail
You do not need deep maths. You need to know what a system prompt, a context window, retrieval and tool calling are, and why the model itself cannot be a security boundary. Then work through each risk in the OWASP Top 10 for LLM Applications: prompt injection, sensitive data disclosure, supply chain, poisoning, output handling, excessive agency and the rest. Always learn the defence alongside the risk. Use MITRE ATLAS to see real case studies and the techniques behind them, and the NIST AI Risk Management Framework to understand how organisations make decisions about AI risk.
The cybersecurity cheat sheet in its AI security edition keeps each of these ideas to a line or two for revision.
Step 3: build something, then break and fix it
This is what separates you from people who only collect jailbreak screenshots. Build a small LLM app of your own: a chat with a system prompt, retrieval over a few documents and one harmless tool. Threat model it. Test it with an eval or scanning tool such as promptfoo or garak. Fix what you find: narrower tools, output encoding, permission checks before retrieval, limits on cost. Turn every finding into a test that runs on each change.
Only ever test apps you own or programmes that explicitly invite testing. Probing a company's public chatbot "for practice" is unauthorised testing, and it is exactly the kind of judgement employers screen out.
If you want a bigger project, these final year ideas are built for this path:
- Prompt injection regression test harness for RAG support chatbots
- AI agent tool permission gateway with human approval
- Model file supply chain scanner for open model downloads
Step 4: aim at the roles that lead there
Apply for AppSec, security engineering, backend or ML engineering roles, and point to your hardened LLM app and its test suite. Once inside, volunteer for the AI features. Within a year or two you can be the person your team trusts with LLM risks, which is how most AI security specialists I know got there. Certifications such as CompTIA SecAI+ can come later; they expect some security experience first.
What I would skip
Skip courses that promise to make you a "certified AI hacker" in a weekend, and skip spending months memorising jailbreak prompts. Models change every few months and those tricks age quickly. Design skills, testing discipline and clear write-ups last.
You can browse more career questions like this one in the questions library.
Want help with your plan?
If you want a second pair of eyes on your route into AI security, create a free account and book a 1:1 session with me. Bring your current skills and the app you plan to build, and we will turn it into a realistic plan.
Was this answer helpful?
Your situation is not quite this one?
Members get written answers to their own questions, a roadmap built for them and feedback on their projects. Early access is open: sign up and your account is active shortly after. Prefer to talk? A free call works too.