The AI security engineer interview process

Few employers publish an AI security loop, and pages that claim to know every company's rounds are mostly guessing. The best-documented loop is Amazon's security engineer process: a 60-minute technical phone screen, sometimes two, then a loop of five 60-minute interviews with members of its security engineering community, each including two or three behavioural questions. Amazon lists the competencies it assesses: secure code review, scripting and automation, threat modeling, security testing, web vulnerabilities and mitigations, cryptography and security fundamentals.

OpenAI publishes a company-wide guide: introductory calls, one or more skills-based assessments, then a final round of four to six interviewers, about four to six hours in total. Anthropic's candidate guidance confirms take-home assessments and live interviews, completed without AI assistance unless stated otherwise. Beyond those, public data on AI security loops is thin, and our company pages say so rather than inventing rounds.

Across what is published and reported, AI security loops are assembled from a small set of round types. A screen with a recruiter or hiring manager checks background and motivation. A technical screen mixes security fundamentals with a short coding or scripting task. A security design round asks you to threat-model a system, increasingly an LLM feature, a RAG application or an agent with tools, and to defend your controls under follow-up questions.

A secure code review round hands you code and asks what is wrong and how you would fix it; in AI loops the code often passes model output somewhere dangerous. A knowledge round probes depth on prompt injection, the OWASP Top 10 for LLM Applications, identity or cryptography. A behavioural round asks for evidence from your past work. Research and red team roles often add a deep dive or presentation on something you found or built.

Design rounds score whether you start from the threat model: what is being protected, from whom, and along which path, before naming a single control. They score whether you explain each control by its mechanism and its failure mode, and whether you separate prevention, detection and containment. Saying that prompt injection is unsolved and designing for a model that will sometimes be fooled scores higher than claiming a filter stops it.

Code review rounds score systematic reading: tracing untrusted input to every sink, not spotting one bug and stopping. Knowledge rounds score precise definitions and the ability to apply them to the system in front of you. Behavioural rounds score specific outcomes you can describe and measure.

The family of employer predicts the loop better than its size. Frontier labs test depth on their own risks: red team roles at Anthropic ask for model jailbreaking and testing agentic workflows for prompt injection alongside classic web application security. Big tech AI security roles sit inside large security organisations and keep their standard security engineering loops, with AI-specific design questions added.

Security vendors mostly hire engineers and researchers to build AI security products, which shifts the loop toward product engineering and threat research. Banks and data platforms hire to secure their own AI adoption, so expect more architecture, governance and risk questions.

Prepare the foundations first, because they are where AI-focused candidates most often lose rounds. Then practise design answers out loud against a clock: draw the data flow, mark the trust boundaries, name the attacker's path, choose controls and say how each one fails. Rehearse two or three stories from your own work that show judgment under ambiguity. For research and red team roles, prepare a clear account of one thing you found, how you measured it and what changed because of it.