Phase 9: Career & Portfolio · 45 min · OWASP GenAI Security Project · MITRE ATLAS · GitHub

Certifications & Community

In a field with no established playbook, your GitHub contribution history is a more current credential than any exam.

Hiring signal: AI security hiring managers consistently say the same thing about certifications in this field: they're a weak, lagging signal. CISSP and CAISP prove you passed a test written months or years ago; a merged pull request against the OWASP LLM Top 10 repo, a MITRE ATLAS technique writeup, or an active presence in the OWASP LLM Slack proves you're tracking a threat landscape that changes monthly. Candidates who show both — a credential in progress and an active community footprint — read as substantially more current than candidates with a certification alone.

What you will learn

Evaluate the current certifications landscape (CAISP, AAISM, CISSP with AI specialization) for what each actually signals to a hiring manager
Identify a concrete first contribution to the OWASP LLM Top 10 project appropriate to your current skill level
Explain what the AI Village at DEF CON and the MITRE ATLAS community are, and how to participate in each without attending in person
Build a personal study-plan checklist that sequences a certification, a community contribution, and an ongoing learning channel

The Problem

Ask ten AI security hiring managers whether a candidate needs a certification and you'll get ten different answers, but almost all of them will say the same thing about why certifications matter less here than in traditional security: the field doesn't have a CPA-license equivalent yet. CISSP has existed since 1994 and every security hiring manager knows exactly what it means. CAISP launched in the last few years. AAISM is newer still. None of them have accumulated the decades of hiring-manager trust that CISSP has in traditional AppSec.

That doesn't mean certifications are worthless — it means they play a different role than you might expect. A certification signals that you sat through a curriculum and passed a scenario-based exam at a point in time. It does not signal that you're tracking a threat landscape that changes monthly: a new jailbreak technique goes viral on X, a new CVE against a RAG pipeline gets disclosed, OWASP ships a new revision of the LLM Top 10. The credential that actually moves the needle in this field is the combination of one certification in progress or completed plus visible, ongoing community participation — because the second one is the only proof that your knowledge isn't already six months stale.

A credential and a community footprint answer different questions
A certification answers "did you study a broad curriculum." A merged pull request against the OWASP LLM Top 10 repo, or a MITRE ATLAS technique mapped to your own project, answers "are you tracking what's happening right now." Hiring managers who have been burned by candidates with a badge and no practical fluency have started asking for the second thing explicitly — "what have you contributed to the community" is a real interview question in this field, not a soft-skills afterthought.

The Certifications Landscape, Honestly

Three certifications are worth evaluating right now. Here's what each one actually signals — not the marketing copy on its landing page.

CAISP (Certified AI Security Professional) — issued by Practical DevSecOps. A 6-hour, roughly 600-question scenario-based exam covering LLM/RAG vulnerabilities, AI supply chain risk, and compliance frameworks like ISO/IEC 42001 and the EU AI Act. No formal prerequisite. This is the most technically hands-on of the three, and the scenario format means it's closer to applied knowledge than trivia recall. Its honest limitation: it's a newer credential with a smaller hiring-manager recognition base than CISSP or CISM, so you still need a portfolio artifact behind it (see lesson 09.01) — most hiring managers will ask you to walk through real work regardless of which badge you hold.

AAISM (Advanced in AI Security Management) — issued by ISACA. A 90-question exam across three domains: AI security policy and governance, risk/supply chain management, and security controls. Here's the detail that surprises people: AAISM explicitly requires holding CISM or CISSP first. It is a management-track add-on, not an entry credential. If you don't already hold one of those, this is a multi-year path. What it signals when you do have it: you can operate at the governance layer — advising stakeholders on AI security policy, not just finding vulnerabilities — which carries real weight with compliance-facing hiring managers and auditors.

CISSP + ISC2's AI security track — there is no separate "CISSP with AI concentration" certification. What actually exists: ISC2 has published exam guidance mapping AI security concepts across the existing CISSP domains, and offers a separate "Building AI Strategy" certificate (six on-demand courses, about 16 hours). If you already hold CISSP — which requires five years of paid experience across at least two of its eight domains — stacking the AI Security certificate on top is a fast, credible way to show deliberate, recent investment in the AI-specific extension of a credential a hiring committee already trusts. Describe this accurately on a resume: "CISSP + ISC2 AI Security Certificate," not an invented concentration name.

Certification	Issuer	Prerequisite	Best for
CAISP	Practical DevSecOps	None	AI Security Engineer, LLM App Security Engineer, AI Security Consultant
AAISM	ISACA	CISM or CISSP	AI Governance & Compliance Engineer, AI Security Architect
CISSP + AI Security Certificate	ISC2	5 years' experience for CISSP	AI Security Architect, Governance & Compliance, Consultant

A candidate targeting an AI Governance & Compliance Engineer role is deciding between CAISP and AAISM. They do not currently hold CISSP or CISM. What should they do?

AAISM is explicitly gated behind holding CISM or CISSP — it's a management-track add-on, not an entry point. A candidate without either of those prerequisites cannot sit the AAISM exam yet, regardless of how well-matched it is to their target role. CAISP has no such prerequisite and is directly relevant to AI governance work (it covers ISO/IEC 42001 and EU AI Act content), making it the achievable near-term move, with AAISM becoming realistic later once CISSP or CISM is in hand.

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers Becoming an OWASP LLM Top 10 Contributor, AI Village at DEF CON and the MITRE ATLAS Community, Build It, What to Practice — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.