Security engineer

AI Security

The model is rarely the vulnerability. The credentials, the retrieval corpus, and the tool surface are.

Who this is for

Security engineers and CISOs who have to sign off on an AI system.

What you should be able to do

Threat-model an AI system and specify the controls that let a security team approve it.

Career ladder

The titles this track maps onto. Levels differ between companies. The useful part is the direction, and what each step adds to the one before it.

Security Analyst
AI Security Engineer
Senior Security Engineer
Staff Security Engineer
Principal Security Architect

Tech stack

What the work is actually done with. Grouped by the job each tool does, so the list reads as a system rather than a pile of names.

Threat: STRIDEMITRE ATLASRed teaming
Identity: IAMWorkload identitySPIFFEZero Trust
Controls: Egress allow-listsTool scopingOutput filtering
Detection: Audit logsSIEMAnomaly detection

The delivery flow

The order the work actually happens in. Each step is where a decision gets made and written down, not a chapter heading.

Asset inventory
Threat model
Prompt-injection surface
Retrieval corpus controls
Identity + scoped access
Egress + tool limits
Detection + logging
Incident response

Reference repository structure

A starting layout for this track. The directories are the ones that get added late and hurt. Decisions, evals, policy, lineage. Promoted to the top level where they are visible.

ai-security/
├── threat-models/         # one per trust boundary, dated
├── controls/
│   ├── identity/          # who the agent is, and what it may reach
│   ├── egress/            # allow-list, default deny
│   ├── tools/             # scoping per tool, per tier
│   └── output/            # filtering and redaction
├── red-team/
│   ├── prompt-injection/
│   └── findings/          # with reproduction steps
├── detection/
│   ├── log-schema.md      # attributable to one agent identity
│   └── alerts/
└── ir/                    # runbooks, tested, with owners

Reading path

12 published guides on this track. Every one is a live page on this site. Nothing here is a placeholder.

Reference implementations

Citadel’s open-source repositories for this track. Terraform modules, MCP servers, and reference architectures you can read, fork, and run. Apache/MIT licensed; check each repository for its terms.

Primary sources

The standards, framework documents, and vendor references this track is built against. Go here when you need the authoritative wording rather than a summary. In a security review or an audit, the source is what counts.

Other tracks

Talk through this with an architect