AI agent security is the job of keeping autonomous LLM agents — the ones that call tools, hold credentials, and take actions without a human in the loop — from being turned against you through prompt injection, tool and permission abuse, hijacked agent identity, or unmonitored runtime behavior, and in 2026 it is a real, fast-growing hiring category with its own titles, salary bands, and career ladders. The thing most people get wrong: you do not need a PhD or a machine-learning research pedigree to get in. The overwhelming majority of these roles hire laterally from appsec, pentesting, DevSecOps, SRE, and IAM — the agent layer is new, but the security instincts transfer almost cleanly.

Here's the role map at a glance:

The roles, and what they actually pay#

Comp in this space is wide and messy — treat every number below as a range from public trackers, not a promise. The single biggest variance drivers are level, company type (a frontier lab pays very differently from a mid-market enterprise), and location.

AI / agent security engineer. This is the load-bearing role. You own the question "what can this agent do, and what happens when it's tricked into doing the wrong thing?" — which means threat modeling the agent, scoping tools and permissions, and building the guardrails covered in our agent security best practices. ZipRecruiter puts the US average for "AI Security Engineer" near $153k, while Glassdoor's sample runs higher — an average around $190k with the 90th percentile near $293k. Read that spread as the honest signal: mid-level lands in the $150s, senior and staff push well past $200k.

AI red teamer. The offensive counterpart — you attack agents so the blue team can defend them. Salary reporting bands it roughly $80k–$120k junior, $120k–$170k mid, and $170k–$220k+ for senior and staff, with contract rates commonly quoted at $60–$120/hr. Agentic red-teaming specifically commands a premium over generic model red-teaming, and published safety research plus frontier-lab experience are the largest multipliers, pushing total comp past $300k at the top. If you're building here, our writeup on red-teaming AI agents in CI shows what the work looks like when it's automated into a pipeline.

ML / AI security researcher. This is the role where ML depth actually pays off — you're finding attack classes nobody has named yet and writing the defenses. It concentrates at frontier labs and vendor research teams. Anthropic's public postings for its Frontier Red Team (autonomy, cyber) are representative; OpenAI and Google DeepMind run comparable safety and automated-red-teaming teams. Expect research-scientist comp, which at labs runs high and heavily equity-weighted.

Agent identity / IAM engineer. Underrated and underfilled. When an agent authenticates, holds a token, and reaches into your systems, someone has to decide what identity it carries and what it's allowed to touch — the zero-trust posture for agents and the mechanics of authenticating an agent identity. Vendors like Oasis Security have built their whole product around agentic identity and access governance. This role hires straight out of cloud/IAM backgrounds and is one of the cleaner lateral moves in the space.

AI governance / risk analyst. The non-engineering path in. You map agent deployments to frameworks — NIST AI RMF, ISO 42001, the EU AI Act (whose full enforcement deadline in August 2026 became a genuine forcing function) — and own audits and controls. Hires from GRC, compliance, and audit. Lower ceiling than the engineering roles, but a real door if your background is risk rather than code.

Who's actually hiring#

Three buckets, and all three are posting right now.

Security vendors building agent security. This is the densest hiring pool, because a whole product category got funded in the last two years — the story we covered in the funded agent-security category. HiddenLayer raised $100M in September 2026 explicitly on the back of enterprises rushing to secure AI deployments, and reports that roughly one in eight AI breaches now traces to agentic systems. Zenity launched what it billed as the first AI security platform for autonomous agents in mid-2026 and was named a leader in the space. Add CrowdStrike (Falcon now markets agentic security), Cyera on the data-security side, Oasis Security on agent identity, and Protect AI — every one of them is staffing engineering, research, and red-team roles.

Frontier labs. Anthropic, OpenAI, and Google DeepMind all run safety and red-team organizations, and their postings are public. These are the highest-comp, highest-bar roles, and the ones most likely to want research credentials.

Enterprises deploying agents. The quiet majority. Banks, healthcare, and anyone shipping agents into a regulated workflow is hiring internal agent-security talent — and, per the World Economic Forum figure that keeps circulating, only about 14% of organizations believe they have the AI security talent they need. That gap is your leverage. As one hiring guide put it, the best entry-level opportunities sit inside firms with real agent deployments, not firms still publishing AI strategy slides.

The skills that actually matter#

Ignore the noise; here's the real stack, in rough priority order:

  1. LLM and agent fundamentals — how tool-calling, memory, and autonomous loops actually work. You can't secure a mechanism you can't explain.
  2. Prompt injection and jailbreaks — the signature attack class. Know the difference between them (they are not the same thing) and how to defend against prompt injection in agents.
  3. Tool and permission scoping — least privilege for agents. The "excessive agency" problem is the one that turns a clever prompt into a real breach.
  4. Threat modeling for agents — trust boundaries when the actor is non-human and semi-autonomous.
  5. Classic appsec + cloud + IAM — the foundation nobody skips. Injection, authz, secrets, the CIA triad. This is why appsec people convert so well.
  6. The frameworks — the OWASP GenAI LLM Top 10 and the Agentic Top 10 (insecure tool use, excessive permissions, multi-agent trust boundaries), MITRE ATLAS for adversarial threat intelligence, and NIST AI RMF for governance. These are the vocabulary hiring managers screen for.

How to break in from an adjacent background#

How to skill up fast#

Don't collect certificates — build proof. Stand up a small agent with real tools and attack it yourself: get it to leak a secret, escalate a permission, or execute an unintended action, then write up the fix. Contribute to an open-source AI-security tool. Try bug bounties that accept AI vulnerabilities. Work the OWASP Agentic Top 10 as a checklist against something you actually built. A hands-on demonstration — "here's an agent I broke and here's how I'd have stopped it" — beats a résumé line in a field this new, because almost nobody has ten years of experience. Nobody does. That's exactly why the door is open.