David Wolf · Portfolio Use Case

AI SECURITY · PRODUCT SECURITY · AI SECURITY ENGINEERING

AI Security LLC

The AI Security Engineer's Handbook

A practical field handbook for turning AI security from policy language into executable engineering work, control evidence, and operator-ready workflows.

Created a practitioner-oriented AI Security Engineering Handbook that translates AI risk, governance, product-security, and agentic-system concerns into concrete security engineering tasks, workflows, controls, templates, checklists, evaluation patterns, and implementation guidance for teams building or governing AI-enabled products.

AI Security LLC — The AI Security Engineer's Handbook

Client

AI Security LLC / Independent Research

Engagement Type

Research Product

Period

2026

Role

Author / AI Security Engineer / Product Security Architect

Focus Areas

AI Security Engineering, AI Product Security, AI System Inventory

The Context

AI security teams are being asked to secure systems that do more than generate text. Modern AI products retrieve data, call tools, run workflows, store context, process sensitive information, and trigger actions. A useful handbook has to explain how to secure those surfaces as engineering work, not just as policy.

The Challenge

The AI security field is overloaded with framework language, vendor claims, model-safety debates, and incomplete checklists. Practitioners need a clear operating model: what to inventory, what to threat model, what to test, what to control, what to log, what to review, and what evidence to produce.

What I Did

•Defined AI security engineering as a concrete operating discipline rather than a loose mixture of model safety, compliance, and traditional AppSec
•Mapped the recurring tasks an AI security engineer must perform across discovery, architecture review, threat modeling, control design, testing, evaluation, monitoring, and evidence generation
•Translated AI product-security concerns into practical workflows that security and engineering teams can execute
•Connected prompt injection, excessive agency, RAG authorization, tool-calling risk, data leakage, model behavior, and supply-chain issues to specific engineering controls
•Organized governance requirements into artifacts that can be created, reviewed, and maintained rather than policy statements that sit outside delivery
•Defined reusable templates for assessment, risk review, control mapping, workflow review, model evaluation, and evidence packaging
•Framed AI security work around actual product surfaces: prompts, tools, context stores, APIs, agents, automation workflows, datasets, logs, connectors, and user-facing actions
•Emphasized continuous verification and validation because AI behavior changes with prompts, context, tools, model versions, retrieval sources, and workflow design
•Created a bridge between executive-level AI risk management and backlog-level security tasks
•Positioned the handbook as a durable reference asset for consulting, training, portfolio storytelling, and client delivery

The Outcome

The result is a practitioner-facing reference that strengthens the broader AI Security LLC content system. It gives the Mythos framework an operational companion and gives the State of AI Security Engineering Report a hands-on implementation layer.

Bridge product security, AI governance, agentic workflow security, prompt testing, RAG security, privacy, and control evidence

Across

Portfolio pages, consulting offers, executive briefings, workshops, training material, and advisory engagements

A broader AI security research platform including the Mythos framework and the State of AI Security Engineering Report

Key Deliverables

•AI Security Engineering Handbook
•AI security engineer task taxonomy
•AI product-security workflow guidance
•AI system discovery and inventory guidance
•Agentic-system threat modeling guidance
•Prompt-injection testing and control guidance
•Tool-calling and permission review guidance
•RAG and context authorization guidance
•AI supply-chain and dependency review guidance
•Model and workflow evaluation guidance
•Governance evidence templates
•Security assessment templates
•Control mapping templates
•Executive-to-backlog translation guidance
•Reusable consulting and training material
•Portfolio-safe case-study narrative for AI security engineering roles

Collaboration

The handbook was created as an independent research and practitioner enablement asset. It synthesizes hands-on product security, AI governance, agentic workflow security, security program buildout, and consulting experience into a format that can support engineering teams, executives, clients, and hiring conversations.

At a Glance

Company: AI Security LLC / Independent Research
Industry: AI Security / Product Security / Security Engineering
Engagement Type: Research Product
Role: Author / AI Security Engineer / Product Security Architect
Period: 2026
Location: Remote
Asset Type: Practitioner handbook
Primary Audience: Product-security engineers, AppSec teams, AI platform teams, governance owners, CISOs, security architects, and consultants
Primary Purpose: Translate AI security into executable engineering tasks, workflows, controls, templates, and evidence artifacts
Public Handling: Public-safe research and practitioner asset

Focus Areas

•AI Security Engineering
•AI Product Security
•AI System Inventory
•Agentic Threat Modeling
•Prompt Injection Testing
•Tool Permission Review
•RAG Authorization
•AI Supply Chain Security
•Model and Workflow Evaluation
•Governance Evidence
•Secure AI SDLC
•Control Mapping
•Risk Review
•Security Assessment Templates
•Practitioner Enablement
•Executive-to-Backlog Translation

Tools & Technologies

•AI Security Engineering
•Product Security
•Threat Modeling
•Secure SDLC
•AI Governance
•ISO 42001
•NIST AI RMF
•OWASP Top 10 for LLM Applications
•Prompt Injection Testing
•Agentic AI Security
•RAG Security
•Authorization Design
•Model Evaluation
•Workflow Evaluation
•Security Control Evidence
•Risk Assessment
•Security Architecture Review
•Template Design
•Research Writing
•Practitioner Enablement

Evidence & Artifacts

•AI Security Engineering Handbook
•Task taxonomy
•Control categories
•Assessment templates
•Threat modeling templates
•Governance evidence templates
•Prompt-injection testing guidance
•Agentic permission review guidance
•RAG authorization guidance
•Workflow evaluation guidance
•Executive briefing material
•Consulting enablement material
•Training and workshop source material
•Public-safe portfolio summary

Public-Safe Caveat

This case study describes an independent research and practitioner handbook asset created for public and advisory use. It does not disclose confidential client data. Client-specific examples should remain generalized unless separately approved for attribution.

David Wolf · Portfolio Use CaseAI SECURITY · PRODUCT SECURITY · AI SECURITY ENGINEERING

AI Security LLC

The AI Security Engineer's Handbook

A practical field handbook for turning AI security from policy language into executable engineering work, control evidence, and operator-ready workflows.

Client

AI Security LLC / Independent Research

Engagement Type

Research Product

Period

2026

Role

Author / AI Security Engineer / Product Security Architect

Focus Areas

AI Security Engineering, AI Product Security, AI System Inventory

The Context

The Challenge

What I Did

•Defined AI security engineering as a concrete operating discipline rather than a loose mixture of model safety, compliance, and traditional AppSec

•Mapped the recurring tasks an AI security engineer must perform across discovery, architecture review, threat modeling, control design, testing, evaluation, monitoring, and evidence generation

•Translated AI product-security concerns into practical workflows that security and engineering teams can execute

•Connected prompt injection, excessive agency, RAG authorization, tool-calling risk, data leakage, model behavior, and supply-chain issues to specific engineering controls

•Organized governance requirements into artifacts that can be created, reviewed, and maintained rather than policy statements that sit outside delivery

•Defined reusable templates for assessment, risk review, control mapping, workflow review, model evaluation, and evidence packaging

•Framed AI security work around actual product surfaces: prompts, tools, context stores, APIs, agents, automation workflows, datasets, logs, connectors, and user-facing actions

•Emphasized continuous verification and validation because AI behavior changes with prompts, context, tools, model versions, retrieval sources, and workflow design

•Created a bridge between executive-level AI risk management and backlog-level security tasks

•Positioned the handbook as a durable reference asset for consulting, training, portfolio storytelling, and client delivery

The Outcome

Bridge product security, AI governance, agentic workflow security, prompt testing, RAG security, privacy, and control evidence

Across

Portfolio pages, consulting offers, executive briefings, workshops, training material, and advisory engagements

A broader AI security research platform including the Mythos framework and the State of AI Security Engineering Report

Key Deliverables

•AI Security Engineering Handbook

•AI security engineer task taxonomy

•AI product-security workflow guidance

•AI system discovery and inventory guidance

•Agentic-system threat modeling guidance

•Prompt-injection testing and control guidance

•Tool-calling and permission review guidance

•RAG and context authorization guidance

•AI supply-chain and dependency review guidance

•Model and workflow evaluation guidance

•Governance evidence templates

•Security assessment templates

•Control mapping templates

•Executive-to-backlog translation guidance

•Reusable consulting and training material

•Portfolio-safe case-study narrative for AI security engineering roles

Collaboration

At a Glance

CompanyAI Security LLC / Independent ResearchIndustryAI Security / Product Security / Security EngineeringEngagement TypeResearch ProductRoleAuthor / AI Security Engineer / Product Security ArchitectPeriod2026LocationRemoteAsset TypePractitioner handbookPrimary AudienceProduct-security engineers, AppSec teams, AI platform teams, governance owners, CISOs, security architects, and consultantsPrimary PurposeTranslate AI security into executable engineering tasks, workflows, controls, templates, and evidence artifactsPublic HandlingPublic-safe research and practitioner asset

Focus Areas

•AI Security Engineering

•AI Product Security

•AI System Inventory

•Agentic Threat Modeling

•Prompt Injection Testing

•Tool Permission Review

•RAG Authorization

•AI Supply Chain Security

•Model and Workflow Evaluation

•Governance Evidence

•Secure AI SDLC

•Control Mapping

•Risk Review

•Security Assessment Templates

•Practitioner Enablement

•Executive-to-Backlog Translation

Tools & Technologies

•AI Security Engineering

•Product Security

•Threat Modeling

•Secure SDLC

•AI Governance

•ISO 42001

•NIST AI RMF

•OWASP Top 10 for LLM Applications

•Prompt Injection Testing

•Agentic AI Security

•RAG Security

•Authorization Design

•Model Evaluation

•Workflow Evaluation

•Security Control Evidence

•Risk Assessment

•Security Architecture Review

•Template Design

•Research Writing

•Practitioner Enablement

Evidence & Artifacts

•AI Security Engineering Handbook

•Task taxonomy

•Control categories

•Assessment templates

•Threat modeling templates

•Governance evidence templates

•Prompt-injection testing guidance

•Agentic permission review guidance

•RAG authorization guidance

•Workflow evaluation guidance

•Executive briefing material

•Consulting enablement material

•Training and workshop source material

•Public-safe portfolio summary

Public-Safe Caveat

David Wolf

AI Security · Product Security · Security Leadership

davidwolf.com/resumelinkedin.com/in/davidrwolfdavid@aisecurity.llc

Based on analyzed public signals, not proof of any individual's or company's internal state.

The AI Security Engineer's Handbook

A practical field handbook for turning AI security from policy language into executable engineering work, control evidence, and operator-ready workflows.

The Context

The Challenge

What I Did

•Defined AI security engineering as a concrete operating discipline rather than a loose mixture of model safety, compliance, and traditional AppSec
•Mapped the recurring tasks an AI security engineer must perform across discovery, architecture review, threat modeling, control design, testing, evaluation, monitoring, and evidence generation
•Translated AI product-security concerns into practical workflows that security and engineering teams can execute
•Connected prompt injection, excessive agency, RAG authorization, tool-calling risk, data leakage, model behavior, and supply-chain issues to specific engineering controls
•Organized governance requirements into artifacts that can be created, reviewed, and maintained rather than policy statements that sit outside delivery
•Defined reusable templates for assessment, risk review, control mapping, workflow review, model evaluation, and evidence packaging
•Framed AI security work around actual product surfaces: prompts, tools, context stores, APIs, agents, automation workflows, datasets, logs, connectors, and user-facing actions
•Emphasized continuous verification and validation because AI behavior changes with prompts, context, tools, model versions, retrieval sources, and workflow design
•Created a bridge between executive-level AI risk management and backlog-level security tasks
•Positioned the handbook as a durable reference asset for consulting, training, portfolio storytelling, and client delivery

The Outcome

Bridge product security, AI governance, agentic workflow security, prompt testing, RAG security, privacy, and control evidence

Across

Portfolio pages, consulting offers, executive briefings, workshops, training material, and advisory engagements

A broader AI security research platform including the Mythos framework and the State of AI Security Engineering Report

Key Deliverables

•AI Security Engineering Handbook
•AI security engineer task taxonomy
•AI product-security workflow guidance
•AI system discovery and inventory guidance
•Agentic-system threat modeling guidance
•Prompt-injection testing and control guidance
•Tool-calling and permission review guidance
•RAG and context authorization guidance
•AI supply-chain and dependency review guidance
•Model and workflow evaluation guidance
•Governance evidence templates
•Security assessment templates
•Control mapping templates
•Executive-to-backlog translation guidance
•Reusable consulting and training material
•Portfolio-safe case-study narrative for AI security engineering roles

Collaboration

The AI Security Engineer's Handbook

A practical field handbook for turning AI security from policy language into executable engineering work, control evidence, and operator-ready workflows.