Joshua Tucker
Application Security Engineer
I’m an Application Security Engineer and software builder with 8 years of experience working at the intersection of development and defense. I build practical security systems that help teams ship safely without turning security into a bottleneck.
My work spans AppSec automation, threat modeling, secure code review, and developer workflows. I enjoy building high-performance Go tooling, improving the quality of security signals, and partnering with engineers to make secure implementation the easiest path.
Based in Tempe, Arizona. M.S. in Cybersecurity and Information Assurance, Western Governors University.
Application Security Skills
Application Security Domains
- Secure SDLC Design & Developer Enablement
- Threat Modeling & Application Risk Analysis
- AI Integration & Agentic Workflow Threat Modeling
- Secure Code Review (Manual & Automated)
- Vulnerability Triage & False Positive Reduction
- Software Supply Chain Security (SCA)
Engineering & Automation
- Go (Golang) – Internal Tooling, SDKs, CLIs
- Security Automation & Policy-as-Code
- CI/CD Security (GitHub Actions)
- Security Data Correlation & Workflow Automation
- AI-Assisted Triage, Routing & Pipeline Observability
- API & Web Application Security
Platforms & Tooling
- Snyk, ArmorCode
- GitHub Security & GitGuardian
- Custom SAST, SCA, and Secrets Detection Pipelines
- Claude and GPT Integrations
- Container Security & Image Scanning
- OWASP Top 10, CWE
Professional Experience
Senior Application Security Engineer — ClickUp
Jul 2026 – Present · Remote
- Architected an AI-assisted triage and routing pipeline using Claude and GPT to collect, reduce, and route cross-codebase data.
- Built autonomous execution agents and reusable test harnesses for complex platform validation.
- Designed scheduled, sharded, resumable scans with code-drift detection across full codebases.
- Added pipeline observability for signal quality, precision, throughput, deduplication, and backlog.
- Improved pipeline efficiency by about 78% with context-aware filtering that reduced candidate noise.
- Led threat modeling and technical reviews for AI integrations, agent workflows, webhooks, and platform features.
Application Security Engineer — Teradata
May 2025 – Jul 2026 · Remote
- Cut security metadata discovery from 23 hours to 8 minutes, keeping organization-wide security data under 12 hours old.
- Built a Go SCM migration utility that preserved thousands of historical security decisions.
- Centralized 10,000+ Snyk risk exceptions into an auditable, repository-wide model.
- Created a reusable Go AppSec SDK connecting 900+ repositories with scanning tools and the APSM platform.
- Correlated SCA, SAST, secrets, IaC, and container findings; closed 10,000+ false positives.
- Integrated security guardrails into GitHub Actions and coached engineers through remediation.
Software Development Mentor — GrowthMentor
Jun 2023 – Present · Part-time · Remote
Mentoring engineers on software development fundamentals, system design, and career growth, with a strong emphasis on secure coding practices, automation, and real-world engineering workflows.
Web Platform Engineer — DM Cantor
Jun 2023 – Dec 2024 · Phoenix, AZ
Led application security and performance hardening for public-facing legal platforms handling sensitive client data. Implemented authentication and access control mechanisms, performed secure code reviews, remediated OWASP Top 10 vulnerabilities, and improved overall security posture through dependency management, configuration hardening, and secure deployment practices.
Technical Specialist — Gyde Media
Jan 2021 – Jun 2023 · Remote
Built JavaScript automation and secure digital-asset workflows, implemented authentication and authorization, and led GDPR-aligned data protection and technical architecture work.
Senior Developer — The Sher Agency
Jan 2018 – Jan 2021 · Tucson, AZ
Architected enterprise web applications and CI/CD workflows, led a five-person team, and introduced secure coding and code review standards.
Head Developer — The Sher Agency
Feb 2020 – Jan 2021 · Contract · Hybrid
Managed multiple enterprise client platforms end-to-end while leading a team of developers. Built and maintained enterprise WordPress applications using advanced PHP and custom architectures, established development standards, and improved delivery capacity and quality.
Get In Touch
Interested in discussing security opportunities or collaboration?
Email:
Quick Links:
The Recycle Bin is empty. Empty for kicks?
