What is an AI security engineer?

An AI security engineer secures systems that contain AI models: the applications built on them, the agents that take actions through them, the data they read and the infrastructure that trains and serves them. The work is security engineering in the classic sense, with threat models, controls, reviews and incident response, applied to a component that breaks one of the field's oldest assumptions.

That assumption is that code and data can be kept apart. A SQL database never mistakes a customer's name for a command once queries are parameterised. A language model reads its developer's instructions, the user's message and every retrieved document as one stream of tokens, and any of them can steer what it does next. Most of the job follows from that one fact.

Four things change, and each one produces a body of work. First, prompt injection lets outside authors influence the model through material it reads. Retrieved passages, incoming messages and tool metadata can all contain instructions, despite having no authority to direct the task. Second, behaviour is probabilistic: the same input can pass a filter today and fail it tomorrow, so controls that rely on the model behaving well cannot carry the security weight on their own.

Third, the model becomes an asset and a supply chain. Weights are valuable and can be stolen; model files can execute code when loaded; training and retrieval data can be poisoned. Fourth, agents turn text into actions. Once a model can send email, run code or call an API with a user's credentials, a successful injection stops being an embarrassing answer and becomes a data breach or an unauthorised transaction.

Day to day, the role threat-models features built on language models and decides where trust boundaries sit. It designs the controls that hold regardless of what the model says: permission scoping for tools, encoding of model output before it reaches a browser or shell, access control on retrieval, sandboxes for generated code and limits on where data can be sent.

It reviews agent and Model Context Protocol (MCP) integrations before they ship, runs or commissions red team exercises and turns their findings into regression tests, secures how models and datasets enter the organisation, and handles incidents when an agent does something nobody intended. In regulated companies it also translates frameworks such as the NIST AI Risk Management Framework and the EU AI Act into engineering requirements.

Titles vary more than the work does. Postings seen in 2026 include Security Engineer, Agent Security at OpenAI, Security Engineer on AI Protection at Google, Security Engineer on the AGI Security team at Amazon, and Senior Security Engineer, AI Security at Apple. Microsoft titles the people on its AI Red Team AI Security Researcher, and Anthropic splits the work between a Safeguards red team and its Security Engineering organisation.

Job titles vary, so judge a posting by its duties. When it mentions prompt injection, agents, LLM applications, model or data supply chains, or the OWASP Top 10 for LLM Applications, it is this job or one next to it.

It is not AI for security, which uses machine learning to detect threats or automate a security operations centre. Many postings mix the two, so check which direction the arrow points. It is not trust and safety, which handles harmful content and abuse policy, although red team work often touches both. And it is not machine learning engineering: the role needs to understand how models are trained and served well enough to reason about their data flows, not to train them.

Most AI security engineers arrive from application or product security, cloud security, or software engineering on teams that shipped LLM features. Fewer arrive from machine learning. Whichever route you take, the fundamentals still get tested: Amazon's published preparation page for security engineers lists secure code review, scripting and automation, threat modeling, security testing, web vulnerabilities, cryptography and security fundamentals. The AI-specific material sits on top of that base, not in place of it.