Josh Dukes - Senior Security Engineer

Dates: 2023-07 - 2026-11

Location: Amsterdam, NL

• Lead multiple security reviews across the EMEA region
• Acted as an escalation for security reviewers
• Lead meetings with development partners to explain review findings and implementation guidance
• Performed quality assurance across the global proactive security review program

Dates: 2020-08-01 - 2023-07-31

Location: Seattle, USA

• Advised security leadership team on strategy
• Influenced other teams to align security strategies
• Identified the DAST strategy for handling log4j and designed and direclty supported strategy for handling DAST log4j false positives
• Help teams define their vision in alignment with the larger organization
• Develop new threat modeling methodology to shift security left
• Performed security reviews during peak periods, including reviewing SAST findings

Date: 2017-03-01 - 2020-10-01

Location: Seattle, USA

• Designed and operationalized dynamic analysis tooling that injects dynamic testing to verify Identity an Access Management at integration time (now mandatory for launch of all public AWS services)
• Designed static analysis orchestration framework, wrapping tools like Fortify to increase finding fidelity.
• Performed security reviews, including code and cloud security, during peak periods

Date: 2016-01-01 - 2017-01-01

Location: Seattle, USA

• Threat modeling, code review, and testing MultiScale's product offerings
• Training engineers on security best practices, including secure coding, in the web world
• Reviewing logs and responding to possible security incidents
• Identified HashDos in the Julia language and identified a replacement language for front-end code

Date: 2012-11-01 - 2016-01-01

Location: Seattle, USA

• Scoping, threat modeling, and execution on native and web code assisted penetration tests for Fortune 500 companies
• Code review in multiple languages
• Helping junior engineers correctly assess finding impact and risk
• Helping junior engineers identify correct security mitigations for findings and communicate them to development teams
• Leading team meetings to explain review findings and recommended fixes

• Developed an R&D program for security engineer tooling
• Facilitated improvements in methodology that significantly decreased cooperation overhead
• Drove development teams to internalize security as a practice and thought pattern, rather than an external checkpoint
• Development of the research and tooling processes, and leadership of the teams responsible for internal tool development and research
• Leading consulting engagements
• Writing fuzzer definitions (peach pits) for customers

Date: 2010-01-01 - 2012-10-01

Location: Seattle, USA

• Scoping, threat modeling, and execution on native and web code assisted penetration tests for Fortune 500 companies

Date: 2020-06-23 - 2025-07-25

Location: Seattle, USA

• Organized a group of activists to make public records requests in order to identify police misconduct
• Collaboratively published several articles
• Deanonymized thousands of police accountability reports, allowing other activists to identify dangerous officers