H-1B Visa Information Security Analyst Jobs
Information Security Analyst roles qualify as H-1B visa specialty occupations because they require at least a bachelor's degree in computer science, cybersecurity, or a related field. Employers in finance, healthcare, defense contracting, and tech regularly file LCAs and sponsor H-1B petitions for this role, making it one of the more consistently sponsored positions in the IT security space.
Find H-1B Visa Information Security Analyst JobsOverview
Showing 5 of 887+ Information Security Analyst jobs
See all 887+ Information Security Analyst Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new Information Security Analyst roles.
Get Access To All JobsINTRODUCTION
The Senior IT Security Architect & Information System Security Officer bridges software delivery and enterprise risk management. This role ensures projects are architected securely from day one, minimizing compliance bottlenecks, protecting critical assets, and ensuring rapid, safe deployments. Acting as both the security designer and compliance lead, the position will govern security controls, lead authorization efforts, and guide engineering teams through risk mitigation.
ROLE AND RESPONSIBILITIES
Key Responsibilities & Deliverables:
-
Security Architecture & System Design:
-
Define and enforce security architecture standards across legacy and modern cloud/hybrid environments.
- Conduct threat modeling and risk assessments during initial project design phases to avoid costly security retrofits late in the delivery cycle.
- Establish secure identity and access management (IAM) strategies and modern authentication standards (e.g., SSO, MFA) to ensure authorized staff and external vendors have seamless, zero-trust access to critical applications without compromising data boundaries.
-
Provide oversight and design standards for Disaster Recovery (DR) and incident response plans during initial project blueprints—ensuring business-critical Medicaid systems can rapidly recover from outages or cyber disruptions with minimal operational downtime.
-
ISSO & Compliance Governance:
-
Lead system compliance and authorization efforts aligned with CMS ARC-AMPE standards, including authoring and maintaining the System Security and Privacy Plan (SSPP), Risk Assessment Reports (RARs), and continuous Plan of Action & Milestones (POA&Ms) to ensure federal requirements are satisfied.
- Change Governance & Security Impact Analyses (SIA): Author, evaluate, and review formal Security Impact Analyses (SIAs) for planned enterprise technology (OET) modifications and new capabilities—ensuring system updates do not degrade existing security postures or disrupt live healthcare operations.
-
Serve as the primary liaison for internal and external cybersecurity audits and compliance reviews (e.g., NIST SP 800-53, FedRAMP, CMMC, or ISO 27001).
-
Continuous Monitoring & Risk Mitigation:
-
Establish continuous security monitoring strategies to identify, track, and remediate vulnerabilities in real time.
-
Translate technical vulnerabilities (e.g., CVEs, patch backlogs) into clear business risk terms for project leadership and executive stakeholders.
-
Data Privacy & Healthcare Compliance:
-
Architect end-to-end data encryption and strict access controls to safeguard sensitive citizen data—specifically Protected Health Information (PHI) and Personally Identifiable Information (PII)—ensuring compliance with HIPAA, CMS, and state privacy mandates.
-
Cross-Functional Integration:
-
Collaborate closely with DevOps and engineering teams to embed security automation into CI/CD pipelines (DevSecOps).
- Provide technical leadership and guidance to project teams to balance security controls with project velocity and system performance.
- Serve as the primary security bridge between project teams and executive leadership—ensuring full alignment with the Chief Information Security Officer (CISO) and Architecture Review Board (ARB) standards to eliminate compliance friction early in the development lifecycle.
- Partner directly with the program’s CMS Certification lead to align technical security designs with evolving CMS certification criteria and federal guidance.
BASIC QUALIFICATIONS
- Education: Bachelor’s Degree from an accredited college or university in Computer Science, Cybersecurity, Information Systems, Engineering, or a related field. Master’s degree preferred.
- General Experience: Minimum of ten (10) years of experience in IT system planning, architecture, and security design.
-
Specialized Security/ISSO Experience:
-
Minimum of five (5) years directly performing ISSO functions, security architecture design, or leading system authorization efforts for complex, large-scale IT implementations.
- Demonstrated, hands-on experience authoring, updating, and defending security control baselines, System Security Plans (SSPs), and active POA&Ms under NIST SP 800-53 and CMS compliance frameworks—specifically with direct familiarity in CMS ARC-AMPE (Acceptable Risk Controls for ACA, Medicaid, and Partner Entities) or the MARS-E to ARC-AMPE transition; candidates must be comfortable producing clear, audit-ready regulatory documentation as a regular deliverable.
PREFERRED QUALIFICATIONS
- Certifications (Preferred): Active industry certifications such as CISSP, CISM, ISSAP, or Certified Cloud Security Professional (CCSP).
LOCATION
Location: Remote
Only W2
INTRODUCTION
The Senior IT Security Architect & Information System Security Officer bridges software delivery and enterprise risk management. This role ensures projects are architected securely from day one, minimizing compliance bottlenecks, protecting critical assets, and ensuring rapid, safe deployments. Acting as both the security designer and compliance lead, the position will govern security controls, lead authorization efforts, and guide engineering teams through risk mitigation.
ROLE AND RESPONSIBILITIES
Key Responsibilities & Deliverables:
-
Security Architecture & System Design:
-
Define and enforce security architecture standards across legacy and modern cloud/hybrid environments.
- Conduct threat modeling and risk assessments during initial project design phases to avoid costly security retrofits late in the delivery cycle.
- Establish secure identity and access management (IAM) strategies and modern authentication standards (e.g., SSO, MFA) to ensure authorized staff and external vendors have seamless, zero-trust access to critical applications without compromising data boundaries.
-
Provide oversight and design standards for Disaster Recovery (DR) and incident response plans during initial project blueprints—ensuring business-critical Medicaid systems can rapidly recover from outages or cyber disruptions with minimal operational downtime.
-
ISSO & Compliance Governance:
-
Lead system compliance and authorization efforts aligned with CMS ARC-AMPE standards, including authoring and maintaining the System Security and Privacy Plan (SSPP), Risk Assessment Reports (RARs), and continuous Plan of Action & Milestones (POA&Ms) to ensure federal requirements are satisfied.
- Change Governance & Security Impact Analyses (SIA): Author, evaluate, and review formal Security Impact Analyses (SIAs) for planned enterprise technology (OET) modifications and new capabilities—ensuring system updates do not degrade existing security postures or disrupt live healthcare operations.
-
Serve as the primary liaison for internal and external cybersecurity audits and compliance reviews (e.g., NIST SP 800-53, FedRAMP, CMMC, or ISO 27001).
-
Continuous Monitoring & Risk Mitigation:
-
Establish continuous security monitoring strategies to identify, track, and remediate vulnerabilities in real time.
-
Translate technical vulnerabilities (e.g., CVEs, patch backlogs) into clear business risk terms for project leadership and executive stakeholders.
-
Data Privacy & Healthcare Compliance:
-
Architect end-to-end data encryption and strict access controls to safeguard sensitive citizen data—specifically Protected Health Information (PHI) and Personally Identifiable Information (PII)—ensuring compliance with HIPAA, CMS, and state privacy mandates.
-
Cross-Functional Integration:
-
Collaborate closely with DevOps and engineering teams to embed security automation into CI/CD pipelines (DevSecOps).
- Provide technical leadership and guidance to project teams to balance security controls with project velocity and system performance.
- Serve as the primary security bridge between project teams and executive leadership—ensuring full alignment with the Chief Information Security Officer (CISO) and Architecture Review Board (ARB) standards to eliminate compliance friction early in the development lifecycle.
- Partner directly with the program’s CMS Certification lead to align technical security designs with evolving CMS certification criteria and federal guidance.
BASIC QUALIFICATIONS
- Education: Bachelor’s Degree from an accredited college or university in Computer Science, Cybersecurity, Information Systems, Engineering, or a related field. Master’s degree preferred.
- General Experience: Minimum of ten (10) years of experience in IT system planning, architecture, and security design.
-
Specialized Security/ISSO Experience:
-
Minimum of five (5) years directly performing ISSO functions, security architecture design, or leading system authorization efforts for complex, large-scale IT implementations.
- Demonstrated, hands-on experience authoring, updating, and defending security control baselines, System Security Plans (SSPs), and active POA&Ms under NIST SP 800-53 and CMS compliance frameworks—specifically with direct familiarity in CMS ARC-AMPE (Acceptable Risk Controls for ACA, Medicaid, and Partner Entities) or the MARS-E to ARC-AMPE transition; candidates must be comfortable producing clear, audit-ready regulatory documentation as a regular deliverable.
PREFERRED QUALIFICATIONS
- Certifications (Preferred): Active industry certifications such as CISSP, CISM, ISSAP, or Certified Cloud Security Professional (CCSP).
LOCATION
Location: Remote
Only W2
See all 887+ H-1B Visa Information Security Analyst Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new H-1B Visa Information Security Analyst Jobs.
Get Access To All JobsTips for Finding H-1B Visa Sponsorship as an Information Security Analyst
Align your credentials to SOC code 15-1212
Information Security Analysts fall under SOC code 15-1212. Pull the O*NET profile for this code and confirm your resume reflects the listed knowledge areas, including network security, risk assessment, and incident response, before applying.
Target employers with active LCA filing history
Use Migrate Mate to filter Information Security Analyst roles by employers who have filed Labor Condition Applications for this specific occupation, so you're applying to companies already familiar with H-1B sponsorship for your job title.
Verify prevailing wage level before accepting an offer
Run your target job title and location through the OFLC Wage Search before negotiating. Your offered salary must meet the DOL prevailing wage for your wage level; a Level I offer in a high-cost metro may not clear the threshold.
Confirm your employer is E-Verify enrolled
USCIS requires H-1B petitioners to be enrolled in E-Verify. Ask your recruiter early in the process. If the employer isn't enrolled, they'll need to register before filing your I-129, which can delay your start date.
Flag security clearance roles during the offer stage
Some Information Security Analyst positions require a U.S. security clearance, which H-1B visa holders are generally ineligible to obtain. Confirm the clearance requirement before investing time in a role that can't proceed to sponsorship.
Time your petition filing around the cap lottery
If your employer is cap-subject, USCIS opens H-1B registration in March for an October 1 start date. Confirm your employer's cap-subject status early and plan your offer acceptance timeline around that window to avoid a full-year delay.
H-1B Visa Information Security Analyst: Frequently Asked Questions
Does an Information Security Analyst role qualify as an H-1B specialty occupation?
Yes. USCIS classifies Information Security Analyst as a specialty occupation because the role normally requires at least a bachelor's degree in computer science, information technology, cybersecurity, or a directly related field. A general business or unrelated degree is unlikely to support the petition without additional evidence linking your field of study to the specific job duties.
How do I find employers who sponsor H-1B visas for Information Security Analyst positions?
Migrate Mate surfaces Information Security Analyst roles filtered by employers with verified H-1B LCA filing history for this occupation code, so you're not guessing which companies will sponsor. Employers in financial services, healthcare systems, federal contractors, and large tech firms file the most LCAs for this role title.
Can I work as an Information Security Analyst on OPT before transitioning to H-1B?
Yes. If your degree is in a STEM-designated field such as computer science or cybersecurity, you're eligible for the 24-month STEM OPT extension, giving you up to three years of OPT work authorization. That window covers multiple H-1B lottery cycles and gives you time to secure a cap-subject employer willing to sponsor.
Do security clearance requirements affect H-1B sponsorship for this role?
They can. Many Information Security Analyst positions, particularly those with federal agencies or defense contractors, require a U.S. government security clearance. H-1B visa holders are generally not eligible for these clearances. Confirm clearance requirements before applying; a role requiring clearance cannot realistically proceed to H-1B sponsorship for most foreign nationals.
What happens to my H-1B status if I'm laid off from an Information Security Analyst role?
You have a 60-day grace period from your last day of employment to find a new sponsoring employer, transfer your H-1B to that employer, or depart the U.S. If a new employer files an H-1B transfer petition before the grace period ends, you can start work once the petition is received by USCIS. Acting quickly is critical because the 60-day window doesn't reset.