What an AI Security Engineer Does (and What It Pays)

4 November 20268 min readBrett Iredale

AI security engineers red-team models, defend against prompt injection and lock down agent tools. What the job involves, 2026 pay, skills and routes in.

When I scan the new roles landing on AutomationRoles.ai each morning, there's a cluster of titles that has quietly become one of my favourites. ServiceNow is hiring a Senior Staff AI Security Engineer in Santa Clara and a Senior Staff Security Engineer for AI Safeguards at Moveworks. Lightning AI wants a Senior Application Security Engineer for AI and machine learning. Gong is looking for a Head of AI Security, and Salesforce is hiring a Senior Offensive AI Security Researcher.

So this instalment of our "what each role does" series is the AI security engineer. If the AI agent engineer builds software that can act on its own, the AI security engineer is the person who makes sure it only does what it's meant to. I think it's one of the most important (and most enjoyable) jobs of the agent era, because every company that wants to hand real work to AI needs someone who can make that safe enough to say yes.

What an AI security engineer actually does

Traditional application security asks: can someone make this software do something it shouldn't? AI security asks the same question of a system that reads natural language, follows instructions, calls tools and remembers things. That changes the game, because the "input" is now every email, web page, PDF and tool result the model ever reads.

The best map of the work is the OWASP Top 10 for LLM Applications 2025. Number one is prompt injection, where text slipped into a model's input changes what it does. The list goes on through sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation and unbounded consumption. In December 2025 OWASP added the Top 10 for Agentic Applications for 2026, built with more than 100 experts, which covers agent-specific risks like goal hijack, tool misuse, identity and privilege abuse, agentic supply chain, memory and context poisoning, and insecure agent-to-agent communication. If you want to understand this job, read both lists end to end. They are basically the job description.

In practice, the day-to-day breaks into a handful of themes.

Red-teaming models and agents. This is the offensive side: trying to make a model or agent misbehave before anyone else does. Google DeepMind's Senior Security Engineer, Agentic Red Team ad describes it well: multi-turn testing of production models, "specifically targeting agentic behaviors like tool usage and reasoning chains", and then turning each manual finding into automated "Auto Red Teaming" regression tests so the same weakness never ships again. I love that last part. The job isn't to break things for fun. It's to turn every discovery into a guardrail.

Prompt injection defence. Most of the engineering effort goes here. Treat external content as data rather than instructions, separate trusted from untrusted inputs, check that an agent's next action still matches the user's original task, and require human approval for sensitive actions. None of this is solved with a single filter. It's layered design.

Agent permissions and identity. OWASP's "excessive agency" item is really a permissions problem. Good AI security engineers give each agent its own identity, short-lived and narrowly scoped credentials, and only the tools it needs. If an agent only needs to read a calendar, it should never hold a token that can delete one.

Securing MCP and tool use. As agents connect to tools through the Model Context Protocol, a whole new layer needs securing. The MCP project's own security best practices cover issues like the "confused deputy" problem in proxy servers, token passthrough (which the spec explicitly forbids), server-side request forgery during OAuth discovery, consent before running local servers, and scope minimisation so a token carries only what the current task needs. Reviewing MCP servers and the tools behind them is fast becoming a standard part of this role.

The model supply chain. Models, datasets, prompts, plugins and dependencies all come from somewhere. Lightning AI's ad on our board lists "evaluate open source models and dependencies", "secure model artifacts and distribution pipelines" and "implement integrity validation and provenance controls". Think of it as software supply-chain security, extended to model weights and training data.

Governance. Finally, someone has to translate all of this into policy, risk registers and audit trails. Frameworks like the NIST AI Risk Management Framework and MITRE ATLAS give a shared language for that, and the more senior the role, the more of your week goes into it.

Two AI security engineers reviewing a model threat dashboard with shield icons on a curved monitor in a bright city office

What it pays

The headline number comes from the AI Career Atlas November 2026 index. Across 80 AI companies on 1 November, the Security family had 306 open roles, up five on October, with a posted base salary of $220K–$312K (the medians of published lower and upper bounds). That's higher than Software Engineering at $188K–$275K. And 68% of security postings disclose pay, against 59% for software engineering, which tells me employers know they have to show the money to get these people.

Real ads back that up:

ServiceNow, Senior Staff AI Security Engineer (Santa Clara): base pay of $190,900–$334,100, plus equity and variable pay, per the listing on our board.
Google DeepMind, Senior Security Engineer, Agentic Red Team: US base of $174,000–$252,000 plus a 15% bonus target, equity and benefits.
Lightning AI, Senior Application Security Engineer, AI and Machine Learning: $180,000–$220,000 base, plus bonus and equity.
Trail of Bits, Senior Security Engineer, Agentic AI: a remote US role advertised at $100,000–$220,000 base earlier this year (it has since closed), a useful reminder that consultancies span a wide range.
Samsara, Offensive AI Security Engineer: $157,675–$238,500, as counted in NodJobs' November roundup.

Those are mostly US figures and base pay only, so treat them as a direction rather than a promise. Australian, UK and European salaries will be lower in absolute terms, though the premium over standard security roles tends to travel with the skill set.

Skills and certifications

The pattern in the ads is very consistent. Employers want a strong security foundation first (application security, threat modelling, cloud, APIs, containers, identity and OAuth) with AI knowledge layered on top: how LLMs, retrieval, agents and inference serving actually work, and where they fail. Python is near-universal, and Go and C++ show up often. DeepMind's minimum is five years in red teaming, offensive security or adversarial machine learning, plus hands-on experience developing exploits for generative AI models.

On certifications, I'm honest: in this field a portfolio beats a certificate. That said, ISACA's Advanced in AI Security Management (AAISM) is worth knowing about. It's aimed at people who already hold a CISM or CISSP, and its 90-question exam covers AI governance and program management, AI risk management, and AI technologies and controls. If you're heading for the governance and leadership end, AAISM on top of CISSP or CISM is a clear signal. For hands-on roles, public red-team findings, open-source contributions and conference talks carry more weight.

Routes in

There are three realistic doors.

From application security or pen testing. This is the most common path and, I think, the fastest. You already think like an adversary. Learn how models, retrieval and agents work, then practise on them. Open-source testing tools such as garak, PyRIT and promptfoo are good places to start, and you can point them at a small agent you've built yourself.

From ML or AI engineering. If you already build with models, add security fundamentals: threat modelling, identity and access, OAuth, secure design reviews. ServiceNow's ad is a great example of a role that values deep ML skill applied to security problems.

From governance, risk and compliance. If you live in frameworks and audits, the AI governance side of this job is crying out for people who can turn NIST AI RMF and the OWASP lists into practical controls. That's where AAISM fits neatly.

Whichever door you choose, my practical advice is the same. Build a small agent with a tool or two (using whichever assistant you like, from Grok Bot to Claude to OpenAI's models), connect it to an MCP server, and then try to make it misbehave. Write up what you found, how you fixed it, and the automated test that now proves it stays fixed. That one write-up will do more for your interview than any course certificate.

Who's hiring

Frontier labs hire heavily, but this is far from a lab-only job. On our own board right now you'll find ServiceNow, Salesforce, Gong, Glean and Lightning AI. Consultancies like Trail of Bits sell this expertise to clients. And every bank, hospital and retailer rolling out agents will need it too, which is why I expect this role to spread well beyond tech over the next couple of years.

I'm genuinely optimistic about this one. AI security engineers are the people who let companies say yes to agents with confidence. That's a brilliant place to build a career. You can browse the latest AI security roles on our jobs board.