Become an AI security engineer

Honest note: The ten steps follow the AI Security Engineer course. Network and cloud security basics are not taught here. Extra reading from other courses is listed at the end.

1. 1

   Step 1 of 10

   Understand what is new in AI security

   Explain why instructions and data mixing in one stream creates new attacks.

   Lessons0/1 done

   • ○What an AI Security Engineer DoesCourse: AI Security Engineer

   Before you move on: Try to make a small assistant ignore its rules, and write down what worked.

2. 2

   Step 2 of 10

   Threat-model a system

   Draw the system, mark trust boundaries and rank the threats.

   Lessons0/1 done

   • ○Threat Modeling AI SystemsCourse: AI Security Engineer

   Before you move on: Draw an assistant that reads a shared drive and sends email, and write six ranked threats.

3. 3

   Step 3 of 10

   Understand prompt injection

   Know direct and indirect injection, and the layered defenses.

   Lessons0/1 done

   • ○Prompt Injection & JailbreaksCourse: AI Security Engineer

   Before you move on: Run five attacks on a small assistant and add one defense for each that worked.

4. 4

   Step 4 of 10

   Stop data leaks

   Map the leak paths and keep customers apart.

   Lessons0/1 done

   • ○Data Leakage & PrivacyCourse: AI Security Engineer

   Tool: Model Context Protocol (MCP)

   Before you move on: Write a two-account test that proves one customer cannot see another's data.

5. 5

   Step 5 of 10

   Secure agents and tools

   Give agents the fewest tools and check every tool call in code.

   Lessons0/1 done

   • ○Agent & Tool SecurityCourse: AI Security Engineer

   Before you move on: Write a tool policy with limits, approvals and what the approval screen shows.

6. 6

   Step 6 of 10

   Control the supply chain

   Know the models, packages, data and tool servers you depend on.

   Lessons0/1 done

   • ○Supply Chain & Model RisksCourse: AI Security Engineer

   Before you move on: Make a bill of materials for an AI app and add three controls.

7. 7

   Step 7 of 10

   Red team your own system

   Attack safely, record findings and turn them into regression tests.

   Lessons0/1 done

   • ○Red Teaming & Security TestingCourse: AI Security Engineer

   Before you move on: Run eight attacks, write one full finding and its regression test.

8. 8

   Step 8 of 10

   Add guardrails and monitoring

   Use plain-code limits, useful logs and alerts with owners.

   Lessons0/1 done

   • ○Guardrails, Monitoring & DetectionCourse: AI Security Engineer

   Tool: OpenTelemetryTool: Langfuse

   Before you move on: Design the guardrails, the log fields and three alerts for an assistant.

9. 9

   Step 9 of 10

   Respond to incidents

   Contain first, communicate plainly and learn without blame.

   Lessons0/1 done

   • ○Incident Response for AI SystemsCourse: AI Security Engineer

   Before you move on: Run a tabletop drill and write the first-hour plan and the user message.

10. 10

    Step 10 of 10

    Get interview-ready

    Answer security design questions with a method, and show real artifacts.

    Lessons0/1 done

    • ○AI Security Interviews & Case PracticeCourse: AI Security Engineer

    Before you move on: Answer the web-browsing agent question aloud in ten minutes, and fix your weakest part.