Staffing the AI + Security Hybrid: How to Hire for the Role That Didn't Exist 18 Months Ago

What an AI Security Engineer Actually Does

The role covers a specific set of responsibilities that did not exist in a traditional security engineering job description even three years ago: adversarial testing of LLM-powered applications for prompt injection and jailbreak vulnerabilities, defending against model extraction and inversion attacks, securing the ML supply chain from training data through deployed model artifacts, threat modeling AI systems specifically rather than applying generic application security frameworks, and red teaming agentic systems that can take autonomous actions rather than simply generating text.

That last responsibility deserves particular attention as organizations move from single-turn chatbot deployments to agentic systems that can call tools, access data, and take actions on a user's behalf. The security surface of an agentic system is fundamentally different from a static application, and most traditional application security engineers have never had to think about what happens when the thing they are securing can make its own decisions about what to do next.

Where This Talent Comes From

Because no formal career path produces AI security engineers directly, effective sourcing means understanding the three main feeder paths and their respective strengths and gaps. Application security engineers who taught themselves ML fundamentals bring strong security instincts and threat modeling discipline but may lack a deep understanding of model architecture and training dynamics. ML engineers who moved into security bring genuine model fluency but often lack the adversarial mindset and structured threat modeling background that security-first careers instill. Red teamers who specialized in AI systems bring the strongest combination of adversarial thinking and emerging AI-specific technique, but this group is currently the smallest of the three feeder paths, simply because AI red teaming as a specialty is so new.

Understanding which feeder path a candidate comes from tells you what to probe hardest for in the interview, and what ramp-up support they will likely need in their first six months.

The Skills Matrix

Because this is such a new discipline, a skills matrix is more useful than a single job description when evaluating candidates, since it lets you see exactly where a given candidate's strengths sit.

Why You Can't Post This on LinkedIn and Wait

The sourcing problem for this role is more acute than for almost any other position in this content series, because the community where this talent actually spends time rarely overlaps with traditional recruiting channels. Effective sourcing paths include AI safety research communities and mailing lists, alumni of the DEFCON AI Village, open-source contributors to AI security testing tools, and former members of safety teams at leading AI labs who have moved into applied enterprise roles. A standard job posting will draw a flood of general security engineers claiming AI familiarity, but it will rarely surface candidates who have done this specific work, which is why a targeted, relationship-driven sourcing approach outperforms broad posting for this particular role.

Salary Ranges and Engagement Models

Because most organizations do not yet have enough ongoing AI security work to justify a full-time headcount, this role is filled almost exclusively via contract or specialized consulting engagement rather than permanent hire. Contract rates for AI security specialists currently range from $150 to $220 an hour, reflecting both genuine scarcity and the premium organizations are willing to pay to get ahead of AI-specific risk before it becomes a headline incident. Organizations further along in AI deployment, with multiple production LLM applications and agentic workflows, are beginning to build permanent teams, with full-time compensation in the $170K to $230K range.

Frequently Asked Questions

Do we need a full-time AI security engineer, or can this be a consulting engagement?

For most organizations in 2026, a consulting or contract engagement is the right starting point, since the volume of ongoing work rarely justifies a full-time hire until an organization has multiple production AI systems generating a steady stream of assessment and monitoring work.

How do we evaluate a candidate's prompt injection expertise in an interview?

Ask them to walk through a specific attack they have executed or discovered, including the exact technique and why it worked against the target system's defenses. Vague, high-level descriptions without a concrete example are a signal to probe further.

Is a traditional penetration tester a reasonable substitute?

Not without additional AI-specific training. Traditional penetration testing skills transfer partially, particularly the adversarial mindset, but AI systems introduce attack surfaces, like prompt injection and training data poisoning, that a generalist pentester has typically never encountered.

What certifications exist for this role?

The field is too new for a widely recognized certification to have emerged as a reliable standard. Portfolio evidence, conference talks, and open-source contributions currently carry more signal than any credential.

How fast is demand for this role actually growing?

Demand has moved from a niche concern to a mainstream hiring priority in a very short window, largely tracking the pace at which organizations have moved AI applications from pilot to production, where the security stakes become real.

Should this role sit within security or within the AI/ML team?

Most effective placements sit within security but with a dotted-line relationship to the ML team, since the role needs both organizational independence to challenge AI deployment decisions and close enough proximity to understand what is actually being built.