GenAI Security Engineering
Engineer defenses against prompt injection, jailbreaks, and data exfiltration. Implement PII leakage detection, content safety, and compliance.
Most certificates prove you watched the videos. Ours prove your code runs — AI-assisted to build, held-out to verify.
Verifiable skill graph
10 skill groups · each becomes a signed node on your graph.
Verifiable skill graph
10 skill groups · each becomes a signed node on your graph.
Every lab you pass signs a W3C Verifiable Credential on your public skill graph. Completing the labs in each group below mints one node on that graph — a cryptographic, recruiter-auditable record of the labs you actually passed.
Share the URL on your résumé or with a hiring manager. They click; they see the discipline, the labs you passed, and the verification signature. No honor system, no broker.
How it’s graded. You build a working app and submit it — a lab passes only when both lab scripts pass on your code.
- Guided labs: AI-assisted, with Claude Code, hints, and a per-step answer reveal — so you can't get stuck. Auto-graded on running code.
- Select skills also add a held-out Verified checkpoint — a held-out problem, server-graded with no AI pair-programmer, certifying a single named skill (in beta).
Run the offense program: AI threat modeling (STRIDE-for-LLMs, attack trees), OWASP-LLM-Top-10 / MITRE ATLAS fluency, red-team automation, and adversarial test campaigns — the discipline that frames every other defense.
Attack and defend the prompt surface: direct and indirect/cross-domain injection (via retrieved or tool content), jailbreak/refusal-bypass, red-teaming content filters, and output-encoding to neutralize downstream injection.
Stop data getting out under attack: exfiltration via prompt/output/tool side-channels, system-prompt leakage, and PII-leak detection — the adversarial channels, not corpus or in-feature redaction.
Defend the model itself as an asset: membership-inference, training-data extraction, and model-stealing attacks — and the defenses against them.
Catch the attack and respond to the breach: adversarial anomaly/abuse detection, attack forensics and containment, and post-breach response — not operational on-call or outage IR.
Attack the agent: confused-deputy and tool-poisoning, excessive-agency exploitation, malicious-MCP-server attacks, privilege escalation through tool chains, and sandbox-escape testing.
Poison and defend the retrieval layer: corpus/embedding poisoning, malicious-document injection, retrieval manipulation, and detection vs prevention — attacking the index, not building it.
Secure the AI supply chain and abuse surface: model provenance/signing, malicious-model-file scanning, AI dependency/SBOM, and abuse/token-flooding DoS — not generic endpoint or org-secrets hardening.
Baseline provider access in security tooling: LLM/embedding SDK calls, auth, and retries.
Production Python for security tooling: async, typing, parsing, and error handling.
What you'll ship in production
Core responsibilities this discipline prepares you for.
What you'll ship in production
Core responsibilities this discipline prepares you for.
- 1
Conduct adversarial red-team testing
of LLM systems
- Automate red-teaming with Garak for prompt injection, jailbreak, and data extraction probes
- Run multi-turn adversarial campaigns with Meta GOAT and structured vulnerability reporting
- Execute campaigns against realistic GenAI systems, discover attack vectors, and produce actionable reports
- 2
Implement defense-in-depth guardrails
— input validation, output filtering, content safety
- Layer NeMo Guardrails, Llama Guard 4, Prompt Guard 2, and Model Armor into a unified defense stack
- Configure multi-layer input validation, output filtering, and content classification policies
- Measure the safety-vs-helpfulness tradeoff across different defense layer configurations
- 3
Threat-model GenAI agent systems
— analyze attack surfaces across tools, memory, and inter-agent communication
- Analyze MCP security boundaries, memory manipulation vectors, and inter-agent trust relationships
- Map tool access control surfaces and agent communication channel vulnerabilities
- Threat-model a complete multi-agent system, identify attack vectors, and design targeted mitigations
- 4
Build PII protection
— detect, classify, and redact sensitive data in LLM pipelines
- Integrate Presidio for multi-language PII detection with custom entity recognizers
- Implement masking vs. pseudonymization redaction strategies with compliance validation
- Configure PII protection for a RAG pipeline and verify zero sensitive data leakage in outputs
- 5
Design compliance programs
aligned with OWASP LLM Top 10, MITRE ATLAS, EU AI Act
- Map OWASP LLM Top 10 mitigations to specific technical controls and implementation patterns
- Implement MITRE ATLAS threat taxonomy and NIST AI RMF compliance frameworks
- Create compliance mappings for GenAI systems and design repeatable audit procedures
- 6
Build security monitoring
for GenAI systems
- Build security-specific monitoring dashboards with anomalous prompt pattern detection
- Detect data exfiltration attempts, unusual token patterns, and adversarial input signatures
- Monitor a production-like GenAI system and detect simulated attacks in real time
- 7
Implement incident response
for GenAI security events
- Build GenAI-specific incident response playbooks with severity classification and containment procedures
- Design forensic analysis workflows for LLM interactions and post-incident reporting
- Simulate security incidents and practice the full end-to-end response lifecycle
- 8
Secure GenAI supply chain
— model provenance, dependency scanning, container security
- Verify model integrity with provenance checks and scan dependencies for known vulnerabilities
- Design secure CI/CD pipelines with container image scanning and signing for GenAI deployments
- Audit a complete GenAI application supply chain and implement security controls at each stage
Curriculum
8 courses · each builds on previous goals
Curriculum
8 courses · each builds on previous goals
7 goals unlocked for preview — click to read. Locked goals open with full access.