Press play to start listening
Cybersecurity hiring has an unusual problem: a company can receive hundreds of applications and still struggle to fill a critical role. The reason is often specialization. A security team may not simply need another analyst.
It may need someone who has investigated cloud identity attacks, built detection pipelines, secured Kubernetes environments, reverse-engineered malware, managed privileged access for large organizations, or responded to ransomware inside a complex enterprise network.
Those skills are not evenly distributed across the labor market. For U.S. employers, that is making geography a bigger recruiting constraint. Remote work can solve part of the problem, but not every security role can be performed indefinitely from another country. When a company needs a specialist physically based in the United States, international recruiting can eventually become an immigration and workforce-planning issue as well.
Cybersecurity Demand Is Not Disappearing
The wider technology labor market has changed significantly since the hiring boom of the early 2020s, but cybersecurity remains an area where long-term demand is strong.
The U.S. Bureau of Labor Statistics projects employment of information security analysts to grow 28.5% between 2024 and 2034, from about 182,800 positions to 234,900. It also projects roughly 16,000 openings per year on average during that period.
Those numbers do not mean every cybersecurity vacancy is difficult to fill. They do show that security employment is expected to grow far faster than the U.S. labor market overall.
The more important problem for employers is what job counts fail to show. Security work has become increasingly specialized. An experienced governance professional cannot automatically replace a malware analyst.
A penetration tester may not be the right person to design identity architecture. A strong SOC analyst does not necessarily have the skills to secure an industrial control environment.
That is why a company can have a large applicant pipeline and still face a genuine talent shortage. The relevant question is not simply, “How many cybersecurity professionals are available?” It is, “How many people have the exact experience this environment requires?”
The Hardest Roles Combine Several Skill Sets
Many difficult cybersecurity searches sit at the intersection of multiple disciplines.
A cloud security engineer may need to understand AWS or Azure architecture, identity controls, infrastructure as code, container security, logging, and incident response.
An application security specialist may need software-development experience alongside threat modeling, code review, CI/CD security, and vulnerability management.
A senior detection engineer may need strong knowledge of endpoint telemetry, SIEM architecture, scripting, adversary behavior, and incident investigation.
Candidates who combine several of those capabilities are naturally harder to find than candidates who match a broad title such as “security analyst.”
This is where local recruiting can become restrictive.
The person with the strongest experience for a particular role may be in Canada, Poland, Ukraine, India, Brazil, Israel, Germany, or somewhere else entirely. Cybersecurity expertise already moves across borders through open-source projects, security research, bug bounty programs, threat-intelligence communities, conferences, and incident-response work.
Hiring systems are often more geographically constrained than the security community itself.
AI Is Changing Which Security Skills Matter
AI is removing some repetitive work from cybersecurity teams, but it is not removing the need for experienced practitioners.
Security platforms can already help summarize alerts, enrich indicators, prioritize vulnerabilities, correlate events, generate queries, and speed up investigation workflows. The practical effect is that experienced analysts can spend less time on repetitive processing.
At the same time, enterprise AI is creating new security problems.
Security teams now have to answer questions such as:
- What actions can AI agents execute?
- Which models can access sensitive corporate data?
- How are machine and non-human identities authenticated?
- Can an AI workflow expose secrets or customer information?
- How should activity performed by autonomous agents be logged and investigated?
The result is greater demand for people who can combine traditional security knowledge with cloud infrastructure, identity, software engineering, data governance, or AI architecture.
BLS explicitly identifies increased AI use as one of the factors contributing to projected demand for information security analysts.
For recruiters, this makes broad job titles even less useful. A company may not need “an AI security expert.” It may need an identity engineer who understands AI agents, an application security engineer who can assess LLM-enabled products, or a cloud architect who can design controls around AI workloads.
Those are narrower searches.
Remote International Hiring Is Useful, but It Has Limits
Hiring someone abroad is often the simplest way to widen the candidate pool.
For many security functions, distributed teams work well. They can improve geographic coverage, give employers access to specialized talent, and help security operations run across time zones.
But remote employment does not solve every staffing problem.
Some security professionals need frequent access to internal engineering teams, restricted environments, sensitive infrastructure, physical devices, or systems subject to customer and contractual access requirements. Senior architects and security leaders may also need to work closely with executives, product teams, or operations staff in the United States.
Incident-response work can introduce similar constraints when an investigation involves physical infrastructure, devices, or tightly controlled systems.
The result is a practical distinction:
A company may be able to use international talent remotely without relocating anyone.
But if the role itself needs to be based in the United States, the hiring problem changes.
Global Hiring Also Expands the Security Perimeter
There is another side to international recruitment: adding distributed employees can create additional access risk if security controls are weak.
The answer is not to avoid global hiring. It is to design access correctly. For higher-risk roles, controls should include company-managed devices, phishing-resistant MFA, time-limited administrative access, alerts for unexpected login locations, and immediate access removal during offboarding.
Remote and relocated employees should operate under the same core controls expected across a mature security organization: least privilege, managed endpoints, strong authentication, privileged-access controls, logging, segmentation, secrets management, and rapid revocation of access when responsibilities change.
Location should not substitute for security architecture.
A local employee with excessive production privileges can be a greater risk than an engineer working thousands of miles away under tightly controlled access.
For security leaders, workforce planning and identity architecture therefore need to evolve together.
When Immigration Enters the Hiring Process
For a U.S. employer considering an international specialist, immigration should be examined before the recruiting process is nearly complete.
Companies sometimes identify an ideal candidate first and ask immigration questions later. That can create problems if the expected work location, job duties, education requirements, timing, compensation structure, or candidate background do not fit the path the employer assumed would be available.
There is no single “cybersecurity visa.”
Depending on the position and the individual, different employment-based options may need to be evaluated. Employers considering relocation or longer-term sponsorship can review the framework for employment-based immigration in the U.S. before deciding how an international candidate fits into the hiring plan.
For some professional positions, H-1B may be relevant when the job and candidate meet the applicable requirements. Permanent employment strategies can involve employer-sponsored EB-2 or EB-3 cases, with labor certification required in many situations.
The important point for a security employer is not the visa label. It is timing. Immigration strategy, recruiting strategy, and the actual technical requirements of the position need to match.
Immigration eligibility depends on the position, employer, and candidate, so companies should obtain case-specific legal advice before committing to a sponsorship route.
Technology Roles Already Play a Major Role in Employer Sponsorship
Department of Labor data provides useful context. In its FY2026 Q3 PERM statistics (PDF), covering certifications issued through June 30, 2026, software developers accounted for 23,499 certified applications, or 22.6% of the total. Computer systems analysts accounted for 4,594, while data scientists accounted for 2,536.
These figures should not be treated as cybersecurity sponsorship totals. PERM occupational classifications cover many types of employment, and certification does not mean that a Green Card was later approved or issued.
What the data does demonstrate is narrower but useful: highly technical occupations make up a substantial portion of employer-sponsored permanent labor certification activity.
That matters because modern security roles increasingly overlap with software development, cloud infrastructure, data engineering, systems architecture, and IT management.
Security is no longer a separate department that only installs defensive tools. In many companies, it is built directly into the technology stack.
Four Questions Employers Should Answer Before Recruiting Globally
International recruiting is most effective when the role itself is defined correctly.
Before expanding a cybersecurity search outside the United States, an employer should answer four questions.
1. Does this person actually need to work in the United States?
If the role can be performed remotely without creating operational, contractual, or security problems, relocation may not be necessary.
If close on-site collaboration or U.S.-based access is essential, that should be established before interviews begin.
2. Which skills are genuinely scarce?
A job description with 25 preferred technologies does not prove a talent shortage.
Employers should identify the two or three capabilities they cannot easily train internally. That may be cloud incident response, malware reverse engineering, industrial security, application security architecture, or another narrow specialty.
3. How will technical ability be verified?
Cybersecurity provides better evidence than many professions.
Relevant signals may include incident-response experience, vulnerability research, open-source contributions, conference presentations, security tooling, technical publications, lab work, architecture experience, or previous responsibility for production systems.
These signals often reveal more than a job title.
4. Has sponsorship been considered before the offer stage?
If relocation may be required, the employer should determine early whether sponsorship is realistically compatible with the role and candidate.
Waiting until an offer is accepted can create unnecessary delays or force the company to restart the search.
The Best Candidate Pool Is Larger Than One Labor Market
U.S. companies do not need to choose between domestic training and international recruiting.
They need both.
Junior employees can be developed into security specialists. Experienced IT staff can move into security roles. Automation can reduce repetitive work. Remote teams can expand coverage. International recruiting can help when an employer needs experience that is difficult to find locally.
The right solution depends on the role.
For routine work, automation may be enough. For a position that can remain fully distributed, remote international hiring may make sense. For a highly specialized role that needs to be based in the United States, relocation may become part of the recruiting strategy.
Cybersecurity itself has been international for years. Vulnerabilities, malware, open-source security tools, threat intelligence, and technical research routinely cross borders.
Hiring is catching up.
For U.S. employers competing for highly specific security skills, the most useful question is no longer whether the ideal candidate lives nearby. It is whether the company has a practical hiring, immigration, and security plan for bringing the right person into the role.
(Photo by Joao paulo m ramos paulo on Unsplash)
