Welcome to this week’s edition.

AI security is growing fast, but getting into the field is still messy.

There are new certifications every month, job descriptions asking for three roles in one & endless lists of frameworks people tell you to learn.

So instead of guessing, I went through roughly 100 AI security job postings, spoke with recruiters, reviewed real cloud and AI security interview loops & invited Marcel Velica to contribute his perspective on what actually builds credibility.

Here are the biggest takeaways.

Let’s get into it ~

One stat stood out:

74.8% of cybersecurity job postings in one analysis did not mention a certification at all.

Certifications can still help with HR filters and getting your resume opened.

But they do not prove that you can actually secure an AI system.

What carries more weight is evidence:

One thing I did not expect:

AI-specific certifications appeared rarely in the postings I reviewed.

Framework knowledge appeared much more often.

The recurring ones were:

If you are entering AI security today, I would understand these before collecting five AI certificates.

AI moves too fast for a badge alone to keep you current.

One of the simplest strategies in the guide:

Pull 20 to 30 real job postings for the role you want.

Count what appears again and again.

AWS?

Azure?

Kubernetes?

RAG security?

Prompt injection?

MITRE ATLAS?

NIST AI RMF?

Take the top five recurring topics.

That becomes your study plan for the next three months.

The market is already telling you what to learn.

Marcel Velica contributed three rules that I think summarize AI security very well:

Understand the system before talking about the risk.

Identity → Data → Permissions → Actions → Blast radius

Turn every finding into a decision.

Finding → Impact → Control → Tradeoff → Residual Risk → Decision

Secure the capability, not only the model.

Identity, least privilege, secrets, logging, tool permissions and revocation often matter more than another system prompt.

If an agent can reach too much or do too much, prompt engineering will not save the architecture.

The guide finishes with a simple plan:

Days 1 to 30: Detect what the market is asking for.

Days 31 to 60: Build something around a real AI attack surface.

Examples:

Days 61 to 90: Rewrite your resume around the skills employers actually ask for, practice real interview questions, and start applying.

The goal is simple:

Evidence > badges.

I put the full research into the AI Security Job Cheat Sheet 2026, including the job-posting analysis, framework guidance, recruiter feedback, Marcel’s contribution, real interview questions, certifications and the full 90-day plan.

The full PDF is below 👇

See you in the next one.

–Rami