J-1 Visa Cloud Security Architect Jobs
Cloud Security Architect roles in the U.S. are accessible to international professionals through J-1 visa sponsorship, most commonly under the Trainee or Research Scholar program category. Designated sponsor organizations issue your DS-2019, while the hiring company serves as your host employer. No lottery or annual cap applies.
See All Cloud Security Architect JobsOverview
Showing 5 of 5+ Cloud Security Architect jobs
Have you applied for this role?
Have you applied for this role?
Have you applied for this role?
Have you applied for this role?
Have you applied for this role?
See all 5+ Cloud Security Architect jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new Cloud Security Architect roles.
Get Access To All JobsINTRODUCTION
The Staff Cloud Security Engineer is a critical, hands-on technical role responsible for engineering, implementing, and automating robust security controls within our cloud environments (AWS primarily, with GCP considerations). This role is pivotal in maturing our cloud security posture, securing Included Health's product infrastructure, and directly contributing to the prevention of unauthorized PHI exfiltration. You will help design and develop advanced security solutions, often through code (primarily Python and Go) and automation (Terraform), to address critical challenges in access control, development environment security, and infrastructure hardening. This role requires deep technical expertise in cloud security, strong software development skills for building security tools and automation, and a proactive approach to risk mitigation. You will be a key technical peer to our infrastructure software and engineering teams, driving a culture of security by design and helping to implement solutions that reduce HIPAA incidents. This is a remote role reporting to the Chief Information Security Officer.
Responsibilities
- Design, develop, and implement a comprehensive authorization framework for cloud resources, addressing user roles, resource-specific restrictions, task-based access, and granular engineering access.
- Lead the technical implementation of Just-In-Time (JIT) access control systems for production environments (systems, secrets, data) to minimize standing privileges for engineering and platform teams.
- Collaborate with engineering to integrate data classification (e.g., safe-harbor annotations) with access control mechanisms, ensuring that data sensitivity directly informs access decisions.
- Develop and maintain security automation scripts, tools, and services in Python or Go to streamline security operations, vulnerability management, compliance checks, and incident response.
- Write clean, maintainable, and testable code (primarily Python and Go; familiarity with Ruby is a plus) for security automation, building custom security integrations, and developing security-focused tools.
- Implement and champion Infrastructure as Code (IaC) principles, specifically using Terraform, for programmatic definition, enforcement, and auditing of security configurations.
- Contribute to the design and implementation of centralized security controls, such as an engineering-owned Web Application Firewall (WAF), to manage rate limiting, IP blocking, input validation, and request filtering.
- Partner with engineering teams to establish and implement secure practices for managing the development toolchain (code generation utilities, linters, browser extensions, CLI tools, IDE plugins) to mitigate supply chain risks.
- Design and help implement a secure, "blessed" mechanism for webhook testing in local development environments, blocking unauthorized tunneling tools.
- Define, implement, and enforce container security hardening standards (e.g., least privilege, no unnecessary utilities, limited internet access) in collaboration with engineering teams.
- Drive the remediation of legacy cloud environments, particularly in GCP, by inventorying, assessing, and improving security controls.
- Design and implement solutions for granular data access control in cloud environments, particularly addressing compliance requirements for handling sensitive data.
- Collaborate closely with infrastructure software, engineering, DevOps, and product teams to co-design and integrate robust, automated security controls into systems, architectures, and CI/CD pipelines.
- Act as a subject matter expert on cloud security (AWS, GCP), providing guidance, code reviews (Python, Go), and technical expertise on secure cloud adoption, secure software development, and access control best practices.
- Support organizational change management efforts related to new security controls and practices by providing technical rationale and assisting in the development of new workflows.
- Conduct security assessments, threat modeling, and contribute to incident response, developing automation for prevention and faster response.
- Develop and maintain comprehensive documentation for security architectures, controls, automation scripts, and incident response playbooks.
BASIC QUALIFICATIONS
- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.
- 5+ years of experience in cloud security, with a strong emphasis on designing, developing (primarily in Python and Go), and implementing security solutions in AWS.
- Proven hands-on software development experience, particularly in Python and Go, for security automation, building security tools, and infrastructure management.
- Demonstrable experience designing and implementing robust authorization and access control frameworks (e.g., RBAC, ABAC, policy-as-code) and Just-In-Time (JIT) access solutions.
- Experience with Infrastructure as Code (IaC) with deep proficiency in writing and maintaining Terraform modules for security.
- Experience with containerization (Docker, Kubernetes/EKS), including hands-on experience hardening containerized environments.
- Experience with SDLC security, CI/CD pipeline security integration, and secure software development practices.
- Experience with security logging, monitoring, alerting tools (e.g., SIEM, AWS CloudTrail, CloudWatch, GuardDuty), and scripting against their APIs (Python, Go).
- Experience with cloud security frameworks (especially HIPAA), regulations, and standards.
PAY
The United States new hire base salary target ranges for this full-time position are:
- Zone A: $174,320 - $246,230 + equity + benefits
- Zone B: $191,752 - $270,853 + equity + benefits
- Zone C: $209,184 - $295,476 + equity + benefits
- Zone D: $226,616 - $320,099 + equity + benefits
This range reflects the minimum and maximum target for new hire salaries for candidates based on their respective Zone. Below is additional information on Included Health's commitment to maintaining transparent and equitable compensation practices across our distinct geographic zones.
Starting base salary for you will depend on several job-related factors, unique to each candidate, which may include education; training; skills; years and depth of experience; certifications and licensure; our needs; internal peer equity; organizational considerations; and understanding of geographic and market data. Compensation structures and ranges are tailored to each zone's unique market conditions to ensure that all employees receive fair and great compensation package based on their roles and locations. Your Recruiter can share your geographic zone upon inquiry.
BENEFITS & PERKS
In addition to receiving a great compensation package, the compensation package may include, depending on the role, the following and more:
- Remote-first culture
- 401(k) savings plan through Fidelity
- Comprehensive medical, vision, and dental coverage through multiple medical plan options (including disability insurance)
- Paid Time Off ("PTO") and Discretionary Time Off ("DTO")
- 12 weeks of 100% Paid Parental leave
- Family Building & Compassionate Leave: Fertility coverage, $25,000 for surrogacy/adoption, and paid leave for failed treatments, adoption or pregnancies.
- Work-From-Home reimbursement to support team collaboration home office work
- Your recruiter will share more about the salary range and benefits package for your role during the hiring process.
ABOUT INCLUDED HEALTH
Included Health is a new kind of healthcare company, delivering integrated virtual care and navigation. We’re on a mission to raise the standard of healthcare for everyone. We break down barriers to provide high-quality care for every person in every community — no matter where they are in their health journey or what type of care they need, from acute to chronic, behavioral to physical. We offer our members care guidance, advocacy, and access to personalized virtual and in-person care for everyday and urgent care, primary care, behavioral health, and specialty care. It’s all included. Learn more at includedhealth.com.
Included Health is an Equal Opportunity Employer and considers applicants for employment without regard to race, color, religion, sex, orientation, national origin, age, disability, genetics or any other basis forbidden under federal, state, or local law. Included Health considers all qualified applicants with arrest or conviction records in accordance with the San Francisco Fair Chance Ordinance, the Los Angeles County Fair Chance Ordinance, and California law. Included Health uses AI-assisted tools at select stages of the hiring process to enhance efficiency, consistency, and communication. AI does not make hiring decisions—final decisions are made exclusively by our recruiting and hiring teams.
INTRODUCTION
The Staff Cloud Security Engineer is a critical, hands-on technical role responsible for engineering, implementing, and automating robust security controls within our cloud environments (AWS primarily, with GCP considerations). This role is pivotal in maturing our cloud security posture, securing Included Health's product infrastructure, and directly contributing to the prevention of unauthorized PHI exfiltration. You will help design and develop advanced security solutions, often through code (primarily Python and Go) and automation (Terraform), to address critical challenges in access control, development environment security, and infrastructure hardening. This role requires deep technical expertise in cloud security, strong software development skills for building security tools and automation, and a proactive approach to risk mitigation. You will be a key technical peer to our infrastructure software and engineering teams, driving a culture of security by design and helping to implement solutions that reduce HIPAA incidents. This is a remote role reporting to the Chief Information Security Officer.
Responsibilities
- Design, develop, and implement a comprehensive authorization framework for cloud resources, addressing user roles, resource-specific restrictions, task-based access, and granular engineering access.
- Lead the technical implementation of Just-In-Time (JIT) access control systems for production environments (systems, secrets, data) to minimize standing privileges for engineering and platform teams.
- Collaborate with engineering to integrate data classification (e.g., safe-harbor annotations) with access control mechanisms, ensuring that data sensitivity directly informs access decisions.
- Develop and maintain security automation scripts, tools, and services in Python or Go to streamline security operations, vulnerability management, compliance checks, and incident response.
- Write clean, maintainable, and testable code (primarily Python and Go; familiarity with Ruby is a plus) for security automation, building custom security integrations, and developing security-focused tools.
- Implement and champion Infrastructure as Code (IaC) principles, specifically using Terraform, for programmatic definition, enforcement, and auditing of security configurations.
- Contribute to the design and implementation of centralized security controls, such as an engineering-owned Web Application Firewall (WAF), to manage rate limiting, IP blocking, input validation, and request filtering.
- Partner with engineering teams to establish and implement secure practices for managing the development toolchain (code generation utilities, linters, browser extensions, CLI tools, IDE plugins) to mitigate supply chain risks.
- Design and help implement a secure, "blessed" mechanism for webhook testing in local development environments, blocking unauthorized tunneling tools.
- Define, implement, and enforce container security hardening standards (e.g., least privilege, no unnecessary utilities, limited internet access) in collaboration with engineering teams.
- Drive the remediation of legacy cloud environments, particularly in GCP, by inventorying, assessing, and improving security controls.
- Design and implement solutions for granular data access control in cloud environments, particularly addressing compliance requirements for handling sensitive data.
- Collaborate closely with infrastructure software, engineering, DevOps, and product teams to co-design and integrate robust, automated security controls into systems, architectures, and CI/CD pipelines.
- Act as a subject matter expert on cloud security (AWS, GCP), providing guidance, code reviews (Python, Go), and technical expertise on secure cloud adoption, secure software development, and access control best practices.
- Support organizational change management efforts related to new security controls and practices by providing technical rationale and assisting in the development of new workflows.
- Conduct security assessments, threat modeling, and contribute to incident response, developing automation for prevention and faster response.
- Develop and maintain comprehensive documentation for security architectures, controls, automation scripts, and incident response playbooks.
BASIC QUALIFICATIONS
- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.
- 5+ years of experience in cloud security, with a strong emphasis on designing, developing (primarily in Python and Go), and implementing security solutions in AWS.
- Proven hands-on software development experience, particularly in Python and Go, for security automation, building security tools, and infrastructure management.
- Demonstrable experience designing and implementing robust authorization and access control frameworks (e.g., RBAC, ABAC, policy-as-code) and Just-In-Time (JIT) access solutions.
- Experience with Infrastructure as Code (IaC) with deep proficiency in writing and maintaining Terraform modules for security.
- Experience with containerization (Docker, Kubernetes/EKS), including hands-on experience hardening containerized environments.
- Experience with SDLC security, CI/CD pipeline security integration, and secure software development practices.
- Experience with security logging, monitoring, alerting tools (e.g., SIEM, AWS CloudTrail, CloudWatch, GuardDuty), and scripting against their APIs (Python, Go).
- Experience with cloud security frameworks (especially HIPAA), regulations, and standards.
PAY
The United States new hire base salary target ranges for this full-time position are:
- Zone A: $174,320 - $246,230 + equity + benefits
- Zone B: $191,752 - $270,853 + equity + benefits
- Zone C: $209,184 - $295,476 + equity + benefits
- Zone D: $226,616 - $320,099 + equity + benefits
This range reflects the minimum and maximum target for new hire salaries for candidates based on their respective Zone. Below is additional information on Included Health's commitment to maintaining transparent and equitable compensation practices across our distinct geographic zones.
Starting base salary for you will depend on several job-related factors, unique to each candidate, which may include education; training; skills; years and depth of experience; certifications and licensure; our needs; internal peer equity; organizational considerations; and understanding of geographic and market data. Compensation structures and ranges are tailored to each zone's unique market conditions to ensure that all employees receive fair and great compensation package based on their roles and locations. Your Recruiter can share your geographic zone upon inquiry.
BENEFITS & PERKS
In addition to receiving a great compensation package, the compensation package may include, depending on the role, the following and more:
- Remote-first culture
- 401(k) savings plan through Fidelity
- Comprehensive medical, vision, and dental coverage through multiple medical plan options (including disability insurance)
- Paid Time Off ("PTO") and Discretionary Time Off ("DTO")
- 12 weeks of 100% Paid Parental leave
- Family Building & Compassionate Leave: Fertility coverage, $25,000 for surrogacy/adoption, and paid leave for failed treatments, adoption or pregnancies.
- Work-From-Home reimbursement to support team collaboration home office work
- Your recruiter will share more about the salary range and benefits package for your role during the hiring process.
ABOUT INCLUDED HEALTH
Included Health is a new kind of healthcare company, delivering integrated virtual care and navigation. We’re on a mission to raise the standard of healthcare for everyone. We break down barriers to provide high-quality care for every person in every community — no matter where they are in their health journey or what type of care they need, from acute to chronic, behavioral to physical. We offer our members care guidance, advocacy, and access to personalized virtual and in-person care for everyday and urgent care, primary care, behavioral health, and specialty care. It’s all included. Learn more at includedhealth.com.
Included Health is an Equal Opportunity Employer and considers applicants for employment without regard to race, color, religion, sex, orientation, national origin, age, disability, genetics or any other basis forbidden under federal, state, or local law. Included Health considers all qualified applicants with arrest or conviction records in accordance with the San Francisco Fair Chance Ordinance, the Los Angeles County Fair Chance Ordinance, and California law. Included Health uses AI-assisted tools at select stages of the hiring process to enhance efficiency, consistency, and communication. AI does not make hiring decisions—final decisions are made exclusively by our recruiting and hiring teams.
See all 5+ Cloud Security Architect jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new Cloud Security Architect roles.
Get Access To All JobsTips for Finding J-1 Visa Sponsorship in Cloud Security Architect
Align your credentials to specialty occupation standards
Cloud Security Architect roles typically require a degree in computer science, cybersecurity, or information systems. Document how your foreign credentials map to U.S. equivalents before approaching host employers, since designated sponsors review academic fit when issuing your DS-2019.
Target host employers with active security clearance pipelines
Federal contractors, defense technology firms, and cloud platform providers regularly host J-1 Trainees and Research Scholars for security architecture work. Prioritize employers whose existing compliance infrastructure signals familiarity with DS-2019 obligations and SEVIS reporting requirements.
Search J-1 compatible roles through Migrate Mate
Filter by cloud security and information security job titles to surface U.S. employers whose hiring patterns align with J-1 sponsorship. Migrate Mate lets you identify host employers before you approach a designated sponsor about issuing your DS-2019.
Choose between Trainee and Research Scholar categories carefully
If you hold a foreign degree and have under a year of post-graduation experience, the Trainee category applies. Research Scholar fits senior professionals contributing to applied security research at universities or research institutes. The wrong category triggers DS-2019 rejection even if your host employer agrees.
Build a structured training plan before the sponsor conversation
Designated sponsors require a detailed DS-7002 training plan for Trainee and Intern categories. For cloud security roles, outline specific rotations covering zero-trust architecture, cloud governance frameworks, and incident response, since vague objectives are the most common reason sponsors request revisions.
Check whether your host employer falls under home-residency waiver eligibility
Some J-1 cloud security positions, particularly those funded by a government agency or involving skills on the Exchange Visitor Skills List, carry a two-year home-residency requirement. Confirm your country and funding source with USCIS before accepting an offer to avoid H-1B or green card complications later.
Cloud Security Architect jobs are hiring across the US. Find yours.
Find Cloud Security Architect JobsCloud Security Architect J-1 Visa: Frequently Asked Questions
Which J-1 program category fits a Cloud Security Architect role?
It depends on your career stage. If you're a recent graduate in your first year after completing a degree in cybersecurity or computer science, the Intern category applies. If you have professional experience and are expanding specific skills in cloud security architecture, the Trainee category is the right fit. Senior professionals contributing to applied research at a university or research institute may qualify under Research Scholar instead.
Who actually sponsors the J-1 visa for a cloud security role - the employer or someone else?
The hiring company is your host employer, not your visa sponsor. Your J-1 sponsor is a U.S. Department of State-designated organization, such as Cultural Vistas or CIEE, that issues your DS-2019 form and monitors your program compliance throughout the exchange. The host employer and the designated sponsor are two separate entities, and you'll need agreements in place with both before your visa is issued.
Does the two-year home-residency requirement apply to Cloud Security Architect positions?
Possibly. The two-year home-residency requirement applies if your exchange program is funded by your home government or the U.S. government, or if your home country has listed your occupation on the Exchange Visitor Skills List. Cloud security skills appear on several countries' skills lists. Review your DS-2019 carefully and confirm your situation with USCIS before accepting an offer, since this requirement affects your ability to change to H-1B or apply for a green card.
How do I find U.S. employers who are open to hosting J-1 Cloud Security Architects?
Migrate Mate is the recommended starting point for identifying U.S. employers whose hiring patterns align with J-1 sponsorship for cloud security and information security roles. From there, prioritize employers in federal contracting, cloud infrastructure, or research environments, since these sectors are most familiar with the DS-2019 process and SEVIS compliance obligations that designated sponsors require of host organizations.
What does the DS-7002 training plan need to include for a cloud security position?
The DS-7002 must detail specific learning objectives, not just a job description. For a Cloud Security Architect role, your plan should outline concrete phases covering areas like cloud governance frameworks, identity and access management, zero-trust architecture design, and compliance auditing. Designated sponsors routinely return vague plans for revision, so specificity about measurable skill outcomes at each phase significantly speeds up DS-2019 issuance.
See which Cloud Security Architect employers are hiring and sponsoring visas right now.
Search Cloud Security Architect Jobs