Security engineer: US talent visa (O-1, EB-1A)
The "Security engineer" profession in the "IT / software" field: whether the talent visa fits, which criteria are realistically achievable, what to collect and what AAO decisions in the field show.
Updated: Author: Alina Kanametova"IT / software" field overview
Key answer
Does the talent visa fit for a security engineer?
Yes, a security engineer is a visible profile: practice explicitly names security impact as a working kind of IT contribution. The usual criteria are original contribution (vulnerability classes found, tools that improved product security), high remuneration (security roles), judging (evaluating competitions and work) and a leading role. Document impact beyond a single company.
Usually built on:
Which route fits for a security engineer
| Visa | Who it fits | Next step |
|---|---|---|
| O-1 | Who it fits:Original contribution, High remuneration, Judging, Leading role: through a US employer or agent, no green card | Find your visa |
| EB-1A | Who it fits:Original contribution, Judging, Leading role: a green card by self-petition | Estimate your odds |
| EB-2 NIW | Who it fits:Original contribution, Judging: framed as a project of national importance (Dhanasar) | Build the packet |
Achievable criteria in "IT / software"
- Original contributionrealistic for IT if the contribution went beyond ordinary engineering work and had a noticeable impact on the product, industry, open source, security, AI, data infrastructure, or business processes.
- Leading roleachievable, but you need to prove influence on a key project and the reputation of the organization or product.
- Judginga realistic criterion for IT through evaluating competitions, hackathons, grants, accelerators, technical articles, open source projects, or candidates in professional programs.
- Membershipspossible, but it works only if admission requires selection based on achievements, experience, recommendations, or expert status, not just payment of dues.
- Media about youachievable if there are materials in independent industry sources showing the significance of the development, product, research, or expertise.
- High remunerationoften applicable in IT, especially for senior, staff, principal, architect, ML/AI, security, and leadership roles, if there is market comparison and supporting documentation.
What to collect: evidence for a security engineer
- For contribution: expert letters and materials on how your work improved product or industry security - tools, research, adopted practices.
- For the role: documents on owning a key product's security - impact on compliance, incidents, architecture decisions.
- For judging: invitations to evaluate competitions, grants, technical articles or candidates in professional programs.
- For contribution: independent expert letters showing that the development was used by other teams, companies, the open source community, or affected product metrics, security, cost, speed, or scalability.
- For a critical role: letters from managers and outside specialists, documents about a key project, architectural decisions, ownership, impact on revenue, users, SLA, compliance, implementation of AI/ML, or infrastructure.
- For judging: invitations to serve on a jury, confirmations of participation in evaluating work, judge selection criteria, lists of reviewed projects, certificates, letters from contest organizers or professional programs.
- For membership: association rules that specify applicant requirements, confirmation of membership level, recommendations, proof of selection, and an explanation of why the membership reflects recognition in the profession.
- For publications: articles, interviews, product reviews, mentions of an open source tool, professional podcasts, or industry materials where the specialist or their work is the subject of discussion, not an ad insertion.
- For high pay: employment agreements, offer letters, equity/bonus documents, tax records, payroll, income statements, and market reports for comparable IT roles, region, and seniority level.
Associations
- from real cases
- from real cases
- from real cases
- from real cases
- from real cases
- from real cases
- from real cases
invite-only, fee-based - weaker as a membership criterion
- from real cases
IAITP (International Association of IT Professionals)
- from real cases
IAHD / IAHQD (International Association of Honored Developers)
- from real cases
International Association of Highly Qualified Software Developers
- from real cases
RAEC / AEC (Russian Association for Electronic Communications)
- from real cases
IT Ukraine Association
- from real cases
Organization of Georgian IT Specialists
- from real cases
AITEX
- from real cases
National Association of Digital Economy
Mind the Product
product-management community
Products That Count
product-management association
Judging
Conference / journal peer review (IEEE, ACM)
Where people in "IT / software" publish, win and belong
Most often missing: Original contribution
Community questions
- Foreign-company salary: which country do I compare against?You compare your income against the market of the country where you actually worked and paid taxes, for your occupation. If a foreign company pays you remotely, the community advises comparing against the local market for the role, backed by several statistics sources. Officers usually dispute the comparison method, not the number.
- What documents prove the high-salary criterion?The working combo is proof of your income (contracts, bank statements, tax records) plus a market comparison from several independent sources - official statistics, job aggregators, analytical reports. The community advises showing not just the average but the top of the salary range for your occupation and region.
- How do freelancers close the high-remuneration criterion?Being self-employed is not a blocker: official income documents work - tax filings, bank statements, client contracts. The harder step is the market comparison. The community advises comparing your personal income against salaried professionals in the same occupation and region, without emphasizing the legal form.
- Show income for one year or several?You show income for the same period you benchmark against - usually the last year or the last few years in matching slices. The community notes you should compare against statistically high salaries, not just the average, and that summing several average incomes from different jobs is a weak strategy.
- Do bonuses and RSU count toward the salary criterion?Community opinions differ: formally you compare remuneration, but the comparison must be apples to apples. If market statistics show base salaries, compare your base pay; if you have a tax form with gross income, officers look at the whole figure. The key is an identical basis on both sides of the comparison.
- Does a team or company award count?By default USCIS expects an individual award, and team awards often get discounted. But the community has seen successful cases where the applicant proved the award happened because of them - letters from the organization, a description of their personal role. The alternative: file a team award under contribution or leading role instead of Awards.
The occupation in the U.S. Department of Labor classification (O*NET)
Information Security Analysts O*NET-SOC 15-1212.00
- Median wage (BLS, 2025)
- $129,180a year · $62.11/h
- Projected growth (2024-2034)
- much faster than average(7% or higher)
- Projected openings (2024-2034)
- 16,000
The occupation page on O*NET OnLineThe high-salary criterion: how it is comparedThe approved EB-1A template files this page as Exhibit 1.1
Source: O*NET OnLine (U.S. DOL), wages BLS OES 2025; the median across all U.S. workers in the occupation. Checked 2026-09-09.
From community practice
High remuneration is judged against the market for your profession and region; discussions advise attaching industry salary surveys as a benchmark.
A talk at a selective conference supports original contribution, and the published proceedings support authorship; an invited or keynote talk is valued above a poster in discussions.
Support letters are stronger when written by independent experts familiar with your work who cite concrete results rather than general praise.
Distilled from public community chats - observations, not legal advice.
From community discussions
«Letters are needed that show they are directly interested in your endeavor. For example, not about how cybersecurity is important for the U.S., but specifically about your endeavor in the field of cybersecurity.»
community member · from public community chats
«Hello everyone! I work in DevOps and cybersecurity and I'm looking for co-authors for publications in academic journals. I need to make 5-6 publications for the O-1/EB-1 visa, and it seems that with co-authors the process will go faster and cheaper. I'm interested in topics in AI, DevOps, CyberSec, technology, business, startups — we can discuss what to write to fit your cases as well. I plan to publish in both Russian and foreign publications.»
community member · from public community chats
«Hi everyone! Today I picked up my passports with the visa: O-1A, marketing in cybersecurity, Porto Alegre (Brazil). The admin check took 3 months (noted in the table), but I could only fly to pick up my passport 4 months after it was completed. It felt like I was the first to receive it after admin processing, as no one at the window spoke English 😅 they returned the passports in 3 days, including the day of submission.»
community member · from public community chats
«Okay so, it turns out, in theory I close 2 criteria: 8 (leading or critical role), 9 (high salary). It seems like I could pull criterion 5 (contribution) out of my work, but I'm not sure.»
Anton · from public community chats
Personal opinions of community members from public discussions, not legal advice.
What the chats ask about the Security engineer profession
- 1×Find journals suitable for the EB-1 criteria for the fields of GRC, Cybersecurity, IT audit/compliance.
Where people go wrong - from the chats
- mistakeThe lack of significant achievements in the field of information security may render support letters from employers ineffective.
- mistakeParticipation in cybersecurity competitions and publications in non-professional journals may not confirm qualifications for a talent visa.
- mistakeThe need to provide a detailed description of duties may become a barrier when applying for the O-1 or EB-1 visa.
- mistakeWorking in organizations related to sanctions and in high-risk areas such as cybersecurity may negatively impact the visa process.
- mistakeDifficulties in obtaining an EB-1 visa can arise even with strong experience and achievements in cybersecurity.
Distilled from the public community chats, anonymised; corpus as of June 2026. These are participants' observations, not legal advice and not USCIS statistics.
Chats in your field
Community chat
Rating 51IT and software on EB-1: open-source, talks, articles and leading role for technical specialists.
Knowledge base
Frequently asked questions
- Which talent visa fits for a security engineer?
- Yes, a security engineer is a visible profile: practice explicitly names security impact as a working kind of IT contribution. The usual criteria are original contribution (vulnerability classes found, tools that improved product security), high remuneration (security roles), judging (evaluating competitions and work) and a leading role. Document impact beyond a single company.
- How many criteria do you need to meet?
- At least three (or one major international award); for a security engineer the usual ones are "Original contribution", "High remuneration", "Judging", "Leading role", and "Original contribution" was accepted in 16% of the AAO appeals that claimed it; EB-2 NIW uses the three Dhanasar prongs instead.
- Can a method or a signature program be claimed as a contribution?
- Yes, a method, a signature program, a book or software can be claimed as a contribution if you substantiate its significance: pre-orders or licenses, recommendation letters, media coverage, examples of use. You do not have to collect everything at once - a convincing portion of the evidence of distribution and impact is enough.
- Do conference talks count as a contribution to the industry?
- Talks and presentations are more often treated as recognition of a contribution, and if the conference proceedings are indexed (for example, in Scopus), they can also be counted alongside publications. But in the community's experience conferences alone usually do not meet the contribution criterion - they are often moved to final merits and used to strengthen the role and contribution.
- How do I prove a high salary for the criterion?
- Compare your salary with that of colleagues in the same profession and in your region or country, not with the city average and not with US salaries (otherwise nobody would pass). Show percentiles. As evidence you need a tax return (in Russia the 2-NDFL form) or bank statements, not just an employer's letter; you can add bonuses or a second job.
- Which filing mistakes do the chats name for a security engineer?
- The lack of significant achievements in the field of information security may render support letters from employers ineffective. Participation in cybersecurity competitions and publications in non-professional journals may not confirm qualifications for a talent visa. The need to provide a detailed description of duties may become a barrier when applying for the O-1 or EB-1 visa.
- What do the chats say about the talent visa for a security engineer?
- «Letters are needed that show they are directly interested in your endeavor. For example, not about how cybersecurity is important for the U.S., but specifically about your endeavor in the field of cybersecurity.» - a community member, from the public chats
Other professions in "IT / software"
Understand the terms and compare visas
From the chats and the documents
Documents and templates from the library
BCS Fellowship interview prep guide, Apr 2026Guide7 pages anonymized access on request
NIW Exhibit: Principal Investigator on Two ProjectsTemplate1 page anonymized access on request
USCIS Proposed Rulemaking - Employment-Based Immigrant Petition ReformsGuide1 page anonymized
Checklist - O-1 / EB-1A / EB-2 NIWGuide1 page anonymized access on request
Reference information and community experience, not legal advice and not a USCIS decision. The AAO figures are lessons from appeals, not approval odds; verify on uscis.gov.