Hiring An AI Security Engineer To Defend The AI Features You Already Shipped

What Does An AI Security Engineer Do The Week After Your Agent Ships?

The support agent went live on Tuesday. By Friday somebody pasted a ticket that ended with a line addressed to the model instead of the reader, and the agent read it as an instruction and issued a refund. Nobody wrote a bug. Your AppSec review passed. That gap is the job: the model treats retrieved text as input, and your permission model treated the model as a trusted caller.

An AI security engineer works the seams where those two assumptions meet. Concretely, in the first month: an inventory of every place untrusted text reaches a prompt, a written threat model for each shipped feature, a hard look at what each agent tool can do when called with hostile arguments, and monitoring that fires on the behavior rather than on the payload. The frameworks are already published. OWASP's 2025 list for LLM applications names prompt injection as LLM01, excessive agency as LLM06, and vector and embedding weaknesses as LLM08 ⁴, and job postings in this space are written against that list and against MITRE ATLAS the way an AppSec posting is written against the classic OWASP Top 10 ³.

This is not the same job as breaking a model in a lab. If your problem is adversarial testing of the model itself, read hiring an AI red team engineer instead. The engineer described here defends a product that is already in front of customers, which means the deliverable is a fix and a control, not a finding.

Who Would Have Caught That Refund Before It Went Out?

Ask who on the open market would have read that ticket and seen an instruction rather than a complaint. Application security engineers who already think in trust boundaries pick up the model-specific parts fastest. Detection engineers bring the instinct for monitoring behavior over signatures, which matters because injection payloads are natural language and cannot be blocklisted. And ML platform engineers who have run retrieval pipelines already know where the embeddings and the evaluation suites live.

The unexpected feeders are worth widening for. Abuse and trust-and-safety engineers from consumer platforms have spent years against humans who adapt, which is closer to this work than any certification. Bug bounty hunters with public write-ups on AI features arrive with the exact reflex you want. Further out, SRE-turned-security people are the only ones who will read unbounded token consumption as a denial-of-service problem, and former QA automation engineers build the test rigs without being asked.

One exchange separates the real ones from the performed ones. A performed candidate lists frameworks and names attack categories; a real one asks what your agent is allowed to call before saying anything about attacks, then asks whether the tool checks authorization itself or trusts the caller. After that, watch the vocabulary rather than the claims. The word guardrail should draw a question back: measured against which failures, and what did the false-negative rate look like last month. An offer to demonstrate a jailbreak on a public chatbot is the wrong instinct, because a public chatbot has none of your tools. And the candidate who asks what the refund ceiling was before asking anything about the model has worked your incident somewhere else already.

How Do You See Adversarial Instinct In Sixty Minutes?

They got good by using models constantly and adversarially, on their own work, for years before it was a title. That practice is visible and you can ask for it directly. The strongest candidates have a personal test rig: a folder of prompts they run against every new model, notes on what changed, a habit of reading system cards and then checking the claims against behavior rather than believing them.

Ask what they use an assistant for in their own security work, and listen for a working division of labor. Good answers are specific and unglamorous: generating attack variations at volume, drafting the boring half of a fuzzing script, summarizing a vendor's model documentation and then verifying two claims by hand. Weak answers are either total refusal or total trust. Both mean the same thing, which is that the candidate has not put in the hours.

Then watch them work. Give them a staging copy of the support agent that issued the refund, its tool list, and sixty minutes, and stay in the room without helping. What you are grading is the order of operations. Do they read the tool permissions before they start typing at the model. Do they check whether an injected instruction survives into the retrieval store, which is the difference between a prank and a persistent compromise. When the model produces a confident claim about what it can do, do they take it at face value or go check. That last habit is the whole role in miniature, and an interview question cannot capture it. The candidate who has the refund tool in hand inside twenty minutes, and then goes looking for whether the instruction persisted, has already done the Friday you had.

Where Do You Find AI Security Engineers Who Are Not Already Taken?

Look where the arguments happen rather than where the resumes sit. The OWASP GenAI Security Project has open working groups on the LLM Top 10 ⁴, and the people writing and disputing those entries are the population you want. DEF CON's AI Village runs hands-on adversarial events. The issue trackers of open adversarial tooling, Garak and Microsoft's PyRIT among them, are public and the contributors are self-identifying.

The adjacent-role search is more productive than the title search, because the title is young and the people who hold it are being paid a lot to keep holding it. Search for AppSec engineers at companies that shipped an LLM feature and then wrote publicly about securing it. Search bug bounty platforms for researchers with disclosed findings against AI products. Fintech and healthcare security teams are a quieter source: they have been forced to reason about model risk under existing regulation, and their people are underpriced relative to anyone with a frontier-lab line on the resume.

Demand is not subtle. In Microsoft's 2025 survey of business leaders, 31 percent said they were considering hiring an AI Security Specialist in the next twelve to eighteen months, putting it third on the list of new AI roles under consideration ¹. Assume every candidate you find is in three other processes, and that your competition includes teams that also need an agentic penetration tester and are interviewing the same people for both.

Two Published Salary Series Disagree, So Quote Both

Whoever finds the refund path in an hour has three other processes running, so quote both published series and pick your band on purpose. As of mid-2026, one industry compensation write-up puts total compensation at roughly 150,000 to 220,000 dollars for junior AI security engineers and 450,000 and up at staff or principal, with agentic AI safety specialists commanding a 20 to 30 percent premium ². A separate 2026 careers survey reports base salary alone at 140,000 to 210,000 ³.

The reconciliation matters when you write the offer. The higher series is total compensation at AI labs and well-funded scaleups, and the lower one is base pay across a broader employer set. Both sources publish ranges rather than point estimates for a reason: the title is young, sample sizes are small, and the same posting can mean an AppSec engineer with an LLM feature or a researcher with published attacks. Price against your own senior engineering band plus a premium, and say which band you used.

Money is rarely what kills the offer. What kills it is a candidate concluding they will be a compliance function. The people worth hiring want a mandate to block a launch, direct access to the teams shipping the features, and permission to publish. Ask what they would need to be able to say no to a release, and take the answer seriously. As for location, this work follows the systems: an engineer touching hosted model APIs and cloud retrieval stores is remote-friendly by default, while on-premise model deployments in defense, banking, and healthcare come with badge-in expectations and sometimes a clearance timeline. State which of the two you are before the first call, because it changes the candidate pool more than the salary does.

Screen The Work, Not The Certificate List

A three-year-old specialty has no reliable credential yet, so a resume signal you trust does not exist. What does exist is the work itself, and it is cheap to stage. Build the exercise on the agent that issued the refund, keep it to an hour, and give every candidate the same starting point and the same tool list so the comparison means something.

Write the answer key before the first candidate sees it. Decide in advance what a strong response finds, in what order, and what it does after finding it, because the temptation to grade on charisma is strongest when you have no rubric. Score each finding separately and keep the evidence next to it: which prompt, which moment, what the candidate said. Findings you can point at survive a hiring debate. A general impression does not.

One caution on the legal side. If you are hiring in New York City, Local Law 144 has governed automated employment decision tools since July 2023 and requires a bias audit and candidate notice for tools that substantially assist a hiring decision, and Colorado and the EU have their own timelines. Check with counsel before any assessment tool touches a decision. If the AI features you are securing raise questions of that shape more broadly, an AI governance counsel is a different hire and usually the right one.

See a sample report >