About LoopDev.ai
Training material for building and securing AI, written by practitioners who teach.
What this is
LoopDev.ai started from a simple observation: people are adopting AI tools much faster than anyone is teaching them how to use those tools well, or safely. The compliance team has questions the security team can't answer, the security team worries about threats the engineers haven't heard of, and most individual users were never shown where the sharp edges are.
This site is our attempt to fix that. It is a set of hands-on certification tracks, practice exams, and practitioner articles covering how to work with Claude, from writing a clear prompt to designing and securing a production agent system.
A few principles shape all of it:
- Learn by doing. Labs are exercises you complete, not chapters you skim.
- Questions that teach. Practice items are scenario-based, every distractor is a real technique applied to the wrong problem, and every explanation says why each wrong answer fails.
- Accurate to today. Code is written against the current API, and the material is revised when the platform changes.
- Security throughout. Prompt injection, permissions, and data handling show up in every track, not in a single module at the end.
We have also presented on agentic AI security at BSides San Diego.
The authors
Alex currently serves as Sr. Director of Information Security & Compliance at Faro Health, an AI-native life sciences SaaS company, where he owns the security program end to end, from architecture and audits to board reporting. He scaled the program from scratch to ISO 27001, SOC 2 Type II, HIPAA, GDPR, and ISO 42001 certification while helping accelerate delivery of AI products into top pharmaceutical companies, where the due diligence burden is heavy and security must function as a business enabler rather than a blocker. Over fifteen years, Alex has built five security programs from the ground up across government, healthcare, financial services, and technology, spanning NIST 800-53, CJIS, FedRAMP, NIST 800-171, ISO 9001, HECVAT, SOX, and the EU AI Act.
His current focus is the security surface that AI-native companies face today: MCP servers as an attack vector, prompt injection as a threat class affecting nearly all software, and the governance debt that accumulates when AI adoption outpaces security program maturity. He is a Claude Certified Architect (CCA) and has presented on agentic AI security at BSides San Diego.
Alex teaches cloud computing, including security, data engineering, and machine learning, at ASU's Ira A. Fulton Schools of Engineering, where he built the cloud curriculum in partnership with AWS. In seven years as an instructor, he has received the Fulton Schools Top 5% Teaching Recognition Award, voted by students. He serves as Vice President of ISACA San Diego and is completing his MBA at the University of Arizona (August 2026).
Certifications: CISSP, CISM, CEH, CCA, CCNA, AWS Solutions Architect, Microsoft SC-200.
Chad brings deep expertise in vulnerability management, incident response, and security program design for organizations undergoing AI adoption. He has spent his career building and running security operations for complex enterprises, and brings that operational lens to the material he writes.
Chad's current focus is agentic AI architecture and Claude deployment security, specifically the operational risks that show up when autonomous agents are given tool access, when MCP servers bridge production systems, and when traditional detection tooling fails to surface agent compromise. He builds threat models, logging architectures, and incident response playbooks designed for environments where the first responder is often another agent.
Chad runs the San Diego Claude Code Meetup, a practitioner community focused on secure agentic development, and co-presented on agentic AI security at BSides San Diego.
Frameworks worth knowing
The definitive risk classification for LLM-based applications. A good first map of what can go wrong in anything built on a large language model.
Cloud Security Alliance guidance on AI-specific security controls and cloud-hosted AI risk. Useful when the AI system you are securing runs in someone else's cloud.
The U.S. government's AI Risk Management Framework, a comprehensive voluntary standard for managing AI risk across the full lifecycle. A practical structure for governance programs of any size.
The first international standard for AI management systems. Increasingly demanded by enterprise buyers, regulators, and auditors. Worth understanding even if you never pursue certification.
The EU's comprehensive AI regulation, with extraterritorial reach that applies to non-EU organizations more often than most teams realize. Essential reading for anyone shipping AI to European users.
The global baseline for information security management systems. AI governance programs work best when they extend existing ISO 27001 controls rather than sit beside them.
The Known Exploited Vulnerabilities catalog from CISA, the authoritative source for actively exploited vulnerabilities. A useful benchmark for how fast patching has to move when attackers use AI too.
Start with the track that fits your role.
Questions, corrections, or ideas for new material are always welcome.
Browse the courses →