Infrastructure Security Engineer Jobs in USA with Visa Sponsorship
Infrastructure Security Engineers are strong H-1B visa and O-1 visa candidates. Employers actively sponsor this role because qualified applicants are scarce, and a bachelor's degree in computer science, information systems, or a related field satisfies specialty occupation requirements. For detailed occupation requirements, see the O*NET profile.
Find Infrastructure Security Engineer JobsOverview
Showing 5 of 929+ Infrastructure Security Engineer jobs
See all 929+ Infrastructure Security Engineer Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new Infrastructure Security Engineer roles.
Get Access To All JobsLocation
San Francisco
Employment Type
Full time
Department
Engineering
Compensation
* $180K – $250K • Offers Equity
fal is the generative media ecosystem powering the next generation of AI products. We build the infrastructure, tools, and model access that teams need to move from idea to production, and do it at scale without compromise. For developers and enterprises, fal is the foundation that makes generative media not just possible, but practical: a unified platform where high-performance inference, orchestration, and observability come together to unlock new categories of AI-native products.
As generative media reshapes industries across a market projected to grow by hundreds of billions over the next decade, fal is becoming the ecosystem that ambitious teams build on.
About this role:
We’re hiring a Senior Infrastructure Security Engineer to secure the foundation of fal.ai’s compute platform. You’ll own security below the application layer: the Linux kernel, the hypervisors and sandboxes that isolate workloads, GPU drivers and firmware, and the hosts that run them. You’ll harden the stack, strengthen isolation against untrusted code, and help make GPU compute safe at scale. Proficiency in building with and using AI is central to this role.
What you’ll do
-
Secure Multi-Tenant Isolation
-
Build and maintain the threat model for running code on shared GPU hosts, from containers and microVM down to PCIe, IOMMU, and GPU passthrough
- Design and verify GPU memory and device-state scrubbing between tenants
-
Help roll out hardware-backed isolation where it fits, including confidential computing and attestation
-
Harden the Stack
-
Harden kernel builds and host images: config minimization, LSMs, seccomp, namespace and cgroup policy, secure and measured boot
-
Reduce attack surface in GPU drivers, CUDA runtimes, NVLink/NVSwitch fabrics, BMC, and firmware
-
Assess and Research Vulnerabilities
-
Assess and triage security vulnerabilities in the kernel, hypervisors, GPU drivers, and firmware: judge exploitability and real impact on environment, set severity, and drive fixes or mitigations
- Track vendor bulletins and upstream disclosures, and run kernel and driver patching that keeps pace without disrupting the fleet
-
Conduct vulnerability research on the components we depend on
-
Shape the Program
-
Contribute to the host and isolation security roadmap and evaluate tooling
- Partner with Detection & Response on telemetry, and act as the escalation point for host, kernel, and driver incidents
- Review designs from Infra, Platform, and ML teams, and help make the secure path the default
- Work with GPU vendors, cloud providers, and upstream maintainers on disclosure and fixes
Qualifications/Nice-to-haves
- AI fluency: you use LLMs, agents, and AI coding tools daily to review code, build tooling, and accelerate vulnerability research
- 5+ years in systems or security engineering, with deep hands-on work in the Linux kernel, hypervisors, or device drivers
- Fluent in kernel C, and comfortable in Rust, Go, or Python for tooling
- Strong grasp of virtualization internals: KVM, VFIO, IOMMU/DMA protection, and the tradeoffs between containers, sandboxes, and microVMs
- Has shipped hardening that runs in production at fleet scale
- Has found, triaged, or fixed real vulnerabilities in low-level code and can explain the exploit path
- Communicates risk clearly to different audiences, from kernel engineers to executives
- NVIDIA GPU stack experience: open kernel modules, GSP firmware, MIG, vGPU, or GPU confidential computing
- Confidential computing more broadly: AMD SEV-SNP, Intel TDX, attestation
- Published CVEs, talks, or write-ups on kernel or hypervisor security
- Prior work at a GPU cloud, hyperscaler, or chip vendor
What we offer at fal
- Interesting and challenging work
- A lot of learning and growth opportunities
- We offer visa sponsorship and will help you relocate to San Francisco.
- Health, dental, and vision insurance (US)
- Regular team events and offsites
Compensation
- $180,000 - $250,000 + equity + comprehensive benefits package
U.S. EQUAL EMPLOYMENT OPPORTUNITY INFORMATION:
fal provides equal employment opportunities to applicants and employees without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, protected veteran status, disability, or any other classification protected by applicable law.
Location
San Francisco
Employment Type
Full time
Department
Engineering
Compensation
* $180K – $250K • Offers Equity
fal is the generative media ecosystem powering the next generation of AI products. We build the infrastructure, tools, and model access that teams need to move from idea to production, and do it at scale without compromise. For developers and enterprises, fal is the foundation that makes generative media not just possible, but practical: a unified platform where high-performance inference, orchestration, and observability come together to unlock new categories of AI-native products.
As generative media reshapes industries across a market projected to grow by hundreds of billions over the next decade, fal is becoming the ecosystem that ambitious teams build on.
About this role:
We’re hiring a Senior Infrastructure Security Engineer to secure the foundation of fal.ai’s compute platform. You’ll own security below the application layer: the Linux kernel, the hypervisors and sandboxes that isolate workloads, GPU drivers and firmware, and the hosts that run them. You’ll harden the stack, strengthen isolation against untrusted code, and help make GPU compute safe at scale. Proficiency in building with and using AI is central to this role.
What you’ll do
-
Secure Multi-Tenant Isolation
-
Build and maintain the threat model for running code on shared GPU hosts, from containers and microVM down to PCIe, IOMMU, and GPU passthrough
- Design and verify GPU memory and device-state scrubbing between tenants
-
Help roll out hardware-backed isolation where it fits, including confidential computing and attestation
-
Harden the Stack
-
Harden kernel builds and host images: config minimization, LSMs, seccomp, namespace and cgroup policy, secure and measured boot
-
Reduce attack surface in GPU drivers, CUDA runtimes, NVLink/NVSwitch fabrics, BMC, and firmware
-
Assess and Research Vulnerabilities
-
Assess and triage security vulnerabilities in the kernel, hypervisors, GPU drivers, and firmware: judge exploitability and real impact on environment, set severity, and drive fixes or mitigations
- Track vendor bulletins and upstream disclosures, and run kernel and driver patching that keeps pace without disrupting the fleet
-
Conduct vulnerability research on the components we depend on
-
Shape the Program
-
Contribute to the host and isolation security roadmap and evaluate tooling
- Partner with Detection & Response on telemetry, and act as the escalation point for host, kernel, and driver incidents
- Review designs from Infra, Platform, and ML teams, and help make the secure path the default
- Work with GPU vendors, cloud providers, and upstream maintainers on disclosure and fixes
Qualifications/Nice-to-haves
- AI fluency: you use LLMs, agents, and AI coding tools daily to review code, build tooling, and accelerate vulnerability research
- 5+ years in systems or security engineering, with deep hands-on work in the Linux kernel, hypervisors, or device drivers
- Fluent in kernel C, and comfortable in Rust, Go, or Python for tooling
- Strong grasp of virtualization internals: KVM, VFIO, IOMMU/DMA protection, and the tradeoffs between containers, sandboxes, and microVMs
- Has shipped hardening that runs in production at fleet scale
- Has found, triaged, or fixed real vulnerabilities in low-level code and can explain the exploit path
- Communicates risk clearly to different audiences, from kernel engineers to executives
- NVIDIA GPU stack experience: open kernel modules, GSP firmware, MIG, vGPU, or GPU confidential computing
- Confidential computing more broadly: AMD SEV-SNP, Intel TDX, attestation
- Published CVEs, talks, or write-ups on kernel or hypervisor security
- Prior work at a GPU cloud, hyperscaler, or chip vendor
What we offer at fal
- Interesting and challenging work
- A lot of learning and growth opportunities
- We offer visa sponsorship and will help you relocate to San Francisco.
- Health, dental, and vision insurance (US)
- Regular team events and offsites
Compensation
- $180,000 - $250,000 + equity + comprehensive benefits package
U.S. EQUAL EMPLOYMENT OPPORTUNITY INFORMATION:
fal provides equal employment opportunities to applicants and employees without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, protected veteran status, disability, or any other classification protected by applicable law.
See all 929+ Infrastructure Security Engineer Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new Infrastructure Security Engineer roles.
Get Access To All JobsTips for Finding Visa Sponsorship as an Infrastructure Security Engineer
Target employers with established H-1B filing history
Large technology companies, financial institutions, and defense contractors file H-1B petitions for security engineers consistently. Filtering by employers with prior sponsorship history narrows your search to realistic opportunities rather than companies new to the process.
Frame your resume around infrastructure-specific security skills
Employers and USCIS both scrutinize whether your background matches the role. Highlight specific platforms and protocols: firewall architecture, zero-trust network design, SIEM tools, and cloud security frameworks like AWS Security Hub or Azure Sentinel.
A relevant degree strengthens your specialty occupation case
USCIS evaluates whether the position normally requires a specialized degree. Computer science, cybersecurity, information assurance, or electrical engineering all support the specialty occupation argument. Unrelated degrees create friction that employers and attorneys must address.
Certifications support your petition but do not replace a degree
CISSP, CISM, CompTIA Security+, and cloud security certifications demonstrate competency and help with visa interviews. They strengthen the overall petition package, but USCIS still requires a qualifying degree or its equivalent in years of experience.
Start the sponsorship conversation early in the hiring process
Raising visa needs after an offer creates friction. Mentioning it during initial screening lets recruiters confirm employer policy before both sides invest time. Most large tech and finance employers have immigration counsel on retainer and expect this question.
Browse Infrastructure Security Engineer roles on Migrate Mate
Migrate Mate filters jobs by visa sponsorship availability, so every listing you see reflects an employer willing to sponsor. This removes the guesswork of cold-applying and discovering sponsorship limitations after multiple interview rounds.
Frequently Asked Questions
Do Infrastructure Security Engineer roles qualify for H-1B sponsorship?
Yes. Infrastructure Security Engineer is a specialty occupation under H-1B visa criteria because the role normally requires at least a bachelor's degree in computer science, cybersecurity, information systems, or a closely related technical field. USCIS consistently approves H-1B petitions for security engineering roles at companies that document the degree requirement clearly in the job description and Labor Condition Application.
What degree do I need for an employer to sponsor my visa as an Infrastructure Security Engineer?
A bachelor's degree in computer science, cybersecurity, information assurance, electrical engineering, or information systems satisfies the specialty occupation requirement for most petitions. Degrees in unrelated fields can still qualify if you have substantial coursework in a technical discipline and the employer's attorney builds a supporting argument. Three years of relevant work experience can substitute for one year of formal education if you lack a four-year degree.
Are Infrastructure Security Engineers likely to get selected in the H-1B lottery?
Selection depends on the annual lottery, not the job title. In FY2025, USCIS received roughly 442,000 registrations for 85,000 available slots, producing a selection rate near 25%. Applicants with a U.S. master's degree or higher enter a separate advanced-degree pool, which historically improves selection odds. Some employers pursue cap-exempt petitions through qualifying nonprofit or university affiliations, which bypasses the lottery entirely.
Can I work as an Infrastructure Security Engineer on OPT while waiting for H-1B sponsorship?
Yes. If you graduated from a U.S. university with a STEM-eligible degree, you qualify for a 24-month STEM OPT extension beyond the initial 12-month OPT period, giving you up to three years of work authorization. This window covers at least two H-1B lottery cycles. Your employer must be enrolled in E-Verify to support the STEM extension, which most established tech and finance employers already satisfy.
Where can I find Infrastructure Security Engineer jobs that offer visa sponsorship?
Migrate Mate lists Infrastructure Security Engineer roles specifically filtered for visa sponsorship availability. Every job on the platform reflects an employer willing to sponsor, so you can apply with confidence rather than discovering immigration limitations late in the hiring process. Browse current openings on Migrate Mate to find roles matched to your visa situation.
What is the prevailing wage requirement for sponsored Infrastructure Security Engineer jobs?
U.S. employers sponsoring a visa must pay at least the prevailing wage, which is what workers in the same role, area, and experience level typically earn. The Department of Labor sets this rate to make sure companies aren't hiring foreign workers simply because they'd accept lower pay than a U.S. worker. It varies by job title, location, and experience. You can look up current prevailing wage rates for any occupation and location using the OFLC Wage Search page.