Joshua works in Verizon's Open Source Program Office, where he leads efforts to improve consistency around how Verizon uses open source. As part of his work at Verizon he works upstream on software supply chain security standards and tools; he is a steering committee member and maintainer for the Supply chain Levels for Software Artifacts (SLSA) project, an editor of The Update Framework (TUF) specification, and a maintainer of the in-toto Attestations Framework.