Skip to content
CISO Spotlights

Career profile

CJ Moses

Chief Information Security Officer and VP of Security Engineering, Amazon

Status
Current role, per sources checked 8 August 2025
Appointed
Not stated in the sources
Published

Compiled 27 September 2026 from public records. Each statement below is drawn from the sources listed at the end.

CJ Moses is Amazon's chief information security officer and vice president of security engineering, overseeing security standards across the company's business lines.

Career path

Moses's route into cloud security ran through federal law enforcement. In 1997 he worked as a computer crime investigator for the Air Force, then took what was meant to be a short posting to the FBI that stretched into a four-year assignment on the Moonlight Maze investigation, a cyber-espionage case from the late 1990s.

RSA Conference's expert bio adds detail to that stretch of his record: before AWS, Moses served as an Assistant Section Chief at the FBI, and earlier held Air Force Office of Special Investigations rank as a Special Agent, plus a coordinator post at the Department of Defense's Joint Task Force for Global Network Operations.

He moved to AWS in December 2007, arriving alongside Steve Schmidt (who became AWS's CISO) and distinguished engineer Eric Brandwine to open the company's east-coast office; at that point Moses described his post as Deputy CISO and VP of Security Engineering.

One of the team's first projects was Amazon Virtual Private Cloud; by the end of 2011 the whole Amazon.com web fleet ran on that infrastructure.

Building a company-wide security bar

IT Brew's account of his path to the top seat describes a period as temporary CISO of Amazon's retail business, during which Moses concluded that the company's separate security organizations operated inconsistently.

That observation led him to build the framework that became Amazon's company-wide security organization, protecting employees, customers, systems and data; the resulting reorganization made Moses CISO of AWS while separate CISO roles were set up for Amazon's stores and retail business.

Sources reviewed do not give a date for his move from Deputy CISO into the CISO seat itself, so this profile leaves that step undated.

Sources

  1. 1.
    IT Brewitbrew.com · published 8 August 2025 · checked 27 September 2026 · tier B
  2. 2.
    Amazon Web Servicesaws.amazon.com · published 8 April 2019 · checked 27 September 2026 · tier A
  3. 3.
    RSA Conferencersaconference.com · undated page · checked 27 September 2026 · tier A

Tier A: the organization itself, a regulator or a government page. Tier B: established trade or business press.