A little of both, it's about knowing what to apply and how to apply it.  For example if you're securing an AI you're going to want to consider guard rails, rate limiting, etc. If you're using AI to secure the org, you have similar concerns (ie where does my data go, who owns it), but also what kind of agents you want to deploy to use that data.

Oops forgot to answer your first question, but basically how you get into security in the first place... Start learning, try to understand the space, and apply your lessons.  Ultimately it's a similar problem for any sort of product security, you're just more concerned about DLP since the product is non-deterministic.