② Skill Tree

Skills for this field stack in layers, and the order matters. People who skip Layer 1 build agents that are impressive and unsafe. People who stop at Layer 3 can operate the tools but cannot explain, in an incident review, why a control was insufficient.

The most common failure pattern is an inverted stack: someone learns LangGraph and MCP first, then tries to reason about trust boundaries without ever having drawn one. Agent security is mostly classical security — identity, least privilege, input validation, audit — applied to a component that is non-deterministic and persuadable. Without Layer 1, there is nothing to apply.

The five layers

Layer 1 — Security Foundations — networking, Linux, IAM, cloud security, threat modeling (STRIDE, PASTA), and applied cryptography. Cryptography matters more than it looks: signing, verification, TLS, and key management are the roots of any trust boundary between agents.
Layer 2 — Engineering Craft — Python, Git, REST/GraphQL, Docker/Kubernetes, CI/CD, Terraform, and an observability stack (OpenTelemetry, structured logging, tracing). Observability is not optional here — it is how agent behavior becomes auditable.
Layer 3 — AI Tooling Mastery — AI coding assistants, orchestration frameworks (LangGraph, CrewAI, AutoGen), prompt and context engineering, vector databases and RAG pipelines, and local LLM operation with Ollama or vLLM.
Layer 4 — Agentic Security Specialization — the attack and defense frameworks you are expected to know by name and by structure: OWASP LLM Top 10, OWASP Agentic AI Threats & Mitigations, MITRE ATLAS, NIST AI RMF, the EU AI Act, ISO/IEC 42001.
Layer 5 — Communication & Influence — risk communication in quantitative terms, policy documentation (AUP, model cards, system cards), and acting as translator between legal, compliance, product, and ML teams.

Layer 1 — Security Foundations

Networking, Linux, IAM, cloud, threat modeling, cryptography

Layer 2 — Engineering Craft

Python, Git, APIs, containers, CI/CD, IaC, observability

Layer 3 — AI Tooling Mastery

Coding assistants, orchestration, RAG, vector DBs, local LLMs

Layer 4 — Agentic Security Specialization

The frameworks you must know cold, and what to know from each

Layer 5 — Communication & Influence

Risk communication, policy writing, cross-team translation

How to use the layers

You do not finish a layer before starting the next one. Treat them as depth targets rather than sequential courses: by the end of the 90-Day Plan, you should be operationally fluent in Layers 2 and 3, conversant in Layer 1, structured in Layer 4, and consciously practicing Layer 5 in every write-up you publish.

Layer	Depth after 90 days	How you prove it
1 — Security foundations	Can draw a trust boundary diagram and name the control at each crossing	STRIDE threat model in your portfolio repo
2 — Engineering	Can ship a containerized, traced, CI-tested agent	Repo with tests, Dockerfile, and OpenTelemetry spans
3 — AI tooling	Can build a multi-agent pipeline and expose tools over MCP	The Multi-Agent SOC project
4 — Specialization	Can map any finding to an OWASP/ATLAS/NIST identifier	Findings table in your red team report
5 — Communication	Can explain a finding to a non-technical stakeholder in one page	Executive summary at the top of that report

Layer 4 is deliberately thin here — it is a study map, not the content itself. The substance lives in Threat Landscape (attack side) and Governance & Compliance (defense and assurance side).