Mamta Upadhyay, GenAI Security Lead | Hands-on AppSec & Pentesting for Agentic AI on Influential Women

Influential Woman · Cybersecurity

Mamta Upadhyay

GenAI Security Lead | Hands-on AppSec & Pentesting for Agentic AI, Amazon Web Services (AWS)

Seattle, WA

1Award received

Certifications · Degrees · Memberships

Degree Master's in Information Security Degree Georgia Tech Cert AI Red Teamer Certification (in progress Cert Hack the Box) Cert Machine Learning Certifications (Stanford Online) Member OWASP (Open Web Application Security Project)

Her Story

About Mamta

I work at Amazon Web Services on the security of AI and agentic systems, which is at the forefront of technology today. My work focuses on ensuring that products built on Amazon's Bedrock platform are secure before they launch to customers. When a team starts building a new AI product or service, I get involved from the very beginning, working with them end-to-end through the entire development process. I conduct design assessments before they even start building, reviewing the proposed architecture to identify potential security issues at every point where data flows from the customer's browser to the server and between services. I help teams understand what attack vectors they need to consider and what defenses they need to put in place, just like we lock our houses to defend them. Once products are built, I review their code and also do professional hacking, which in my capacity is called penetration testing, to make sure there are no security loopholes that can be exploited once the product launches. My goal is that when a product goes live, no security incident happens - that's our win. We do everything in the background, and if there are no breaches or bug bounty reports, that means we succeeded. Security is critical work because sometimes things can go as bad as the entire company's reputation being at stake. I have worked on various areas of cybersecurity throughout my career, including the tooling side where you build products, the CICD side where you integrate scanners to ensure products are free of vulnerabilities, application security doing end-to-end assessments, and offensive testing. At Amazon, I work on launches around Bedrock, Agent Core, Bedrock Data Automation, Bedrock Nova, and many other AI and agent-based products. As an L6 lead, I handle all the complex launches and work across application security and penetration testing. I'm very proud of my entire tenure at AWS because I get to work on cutting-edge technologies with so much visibility, and every month without a security incident gives me immense satisfaction knowing I prevented reputational harm to the teams I support.

Her Interview

Ten minutes with Mamta

01What do you attribute your success to?

I started with passion and interest in this field, but what made me stay in it for so long is dedication, patience, and discipline. Those are the things that kept me going through over 15 years in cybersecurity. I just wanted to be in this field from the beginning, and that passion combined with maintaining discipline and patience has been key to my success. It's about staying committed to what you love and being disciplined enough to keep pushing forward even when things get challenging.

02What’s the best career advice you’ve ever received?

The best career advice I ever received was from my brother, who works in machine learning. He kept convincing me to take trainings on AI and machine learning, even though it wasn't relevant to my job at the time. I was in cybersecurity and he was in machine learning, but he always pushed me to learn about AI and take those courses. I would say he is the one who actually pivoted me in this direction. That advice to learn AI and machine learning even when it seemed outside my immediate work turned out to be the best thing for my career. It helped me switch from traditional security to agentic security, which is keeping me at the forefront of the field. My current job at a big tech company is all because of that advice. It taught me the importance of staying ahead of the curve and learning new technologies even when they don't seem directly applicable to your current role.

03What advice would you give to young women entering your industry?

First of all, don't give up, because I have noticed, especially women, after they start a family, they tend to slow down and give up, only to realize a few years down the line that was a bad decision. There are always options - there are options to raise your kids, there are options to get help. You don't have to give up your career for that. I think that's what women lack. I myself had so many issues raising two kids with a husband who is always working in the ICU. It has never been easy, but I have taken all the help. I spent money, I get all the help, but I make sure that I don't give up on my career, because that's the dream I had since one day. I don't want to give up on it just because there are other responsibilities. In fact, if you go through it and come out of it, you become much stronger. Women can do so many things at once - that's our superpower. It's just about dedication. And another thing, not just for women but for every person coming out of college: just keep yourself up to date. It's normal for people, once they settle into a job, to lose out on what's happening in the real world. That's a bad way, because if you come out of that job and you're not caught up, at least you don't know what's happening in terms of tech, you'll feel that you're lagging behind. So always keep up, keep on reading, understand what's happening in the tech world, and if necessary, take the training, even if it's not relevant to your job.

04What are the biggest challenges or opportunities in your field right now?

The biggest challenge is to make people understand the importance of security. Engineers always consider security people as bottlenecks. They want to launch fast, they don't want to wait, and security is always in a catch-up mode. We want them to do it right, but because of competition - Amazon competing with Microsoft, Amazon competing with Google - they want to launch in 15 days. 15 days is never enough for security. Convincing these people that you have to do it right, it's okay to delay the launch, is always a problem with us. Security is a combination of engineering, cybersecurity, people management, and project management. You have to wear multiple hats. You can't just be technically good - you have to be able to convince people and deal with people. There are always escalations and getting in the room and arguing with people. Just this morning, half of my time went into convincing people that this is how you're gonna get affected, and they just don't want to understand. They're like, you are just blocking us, you are slowing us down. But at the end of the day, I feel like I had a day well spent, even though I had people issues to go through. I made sure that security won. It does not win 100% of the time, but even if it wins 80% of the time, there is something we contributed towards it. The challenge is that if there is a security breach, they will do audits and point fingers at security asking who approved it. We take blame both sides - we have to keep on convincing these people, but if something major happens, we are on the receiving end.

05What values are most important to you in your work and personal life?

Maintaining a routine and maintaining discipline are the most important values to me. I also believe in knowing when to stop and being able to context switch from professional life to personal life. It's about having that balance and discipline to separate work from home, while maintaining consistency and routine in both areas of my life.

Join Influential Women and start making an impact. Register now.