Amy Herzog named Chief Information Security Officer (CISO) at AWS

Amy Herzog has been named CISO at AWS, having previously served as CISO of Amazon's Ads Devices and Specialized Business organizations for the past two years. She was appointed following the departure of Chris Betz, who held the AWS CISO role for nearly two years.

CSO Online reports that Herzog, as one of several Amazon CISOs, was responsible for securing advertising products and services as well as hardware devices. Before Herzog joined Amazon in 2023, she held IT management positions at Pivotal, which VMware acquired, and at Travelers insurance, according to CSO Online. CSO Online says Herzog started her career as an engineer for the MITRE Corporation, where she worked for more than 15 years. During her time at MITRE, Herzog co-authored two patents related to cybersecurity, CSO Online reports. CSO Online reports that Herzog has seen the evolution of cloud computing during her career, together with accompanying changes in cloud native security.

Herzog told CSO Online that Amazon begins product development by understanding what customers need, describing this as a working backwards approach. Herzog tells CSO Online that bringing in security specialists early, so they join the design and product teams as collaborative partners, is part of their mantra. Herzog said that rather than code scanning to find and fix issues at the last minute, they do scans throughout the coding lifecycle.

Herzog cited automated scans and ongoing verification steps used to confirm that software updates are properly applied and authentic, CSO Online reports. CSO Online reports that Amazon has a dedicated team of generative AI and security experts who develop security testing and controls for its AI models and services. CSO Online reports that Amazon tests its models with adversarial prompts and with automated and manual red team exercises to find vulnerabilities early.