Last updated: October 2026. Checked against the USCIS Policy Manual (Volume 6, Part F, Chapter 5, current as of October 2, 2026), the BLS Occupational Outlook Handbook, CISA’s critical infrastructure sectors page, the DHS STEM Designated Degree Program List, and White House documents published in March, June and August 2026.
Yes, cybersecurity professionals can qualify for a National Interest Waiver. But an EB2 NIW cybersecurity petition does not succeed just because cybersecurity matters. It turns on three questions. Is the occupation behind your endeavor a profession that needs at least a bachelor’s degree for entry? Does your endeavor reach beyond one employer and its clients? And can you prove your impact when most of your work is confidential? This guide answers each one using USCIS’s own guidance.
It is written for security analysts, engineers, penetration testers, researchers and security leaders. All example endeavors are hypothetical and labelled as such.
Key takeaways
- USCIS decides EB-2 eligibility first, then applies the three Dhanasar prongs (USCIS, January 2025).
- The BLS handbook says information security analysts typically need a bachelor’s degree, but also that some enter “with a high school diploma and relevant industry training and certifications.” Describe your occupation precisely.
- Cyber degree programs such as 11.1003 (systems security and information assurance) and 43.0403 (cyber/computer forensics) appear on the DHS STEM list.
- Protecting one company’s network does not show national importance. Tie the endeavor to a specific problem in a critical infrastructure sector or a named technology priority.
- Confidential work can still be documented through redacted letters, public artifacts such as vulnerability records, adoption by others and third-party corroboration.
How USCIS reviews a cybersecurity NIW petition
Under the USCIS Policy Manual (Volume 6, Part F, Chapter 5), the officer first checks that you qualify for EB-2, as an advanced degree professional or a person of exceptional ability. Only then does the officer apply the three prongs of Matter of Dhanasar, 26 I&N Dec. 884 (AAO 2016): the endeavor has substantial merit and national importance; you are well positioned to advance it; and on balance it would benefit the United States to waive the job offer and labor certification.
The Policy Manual separates two ideas. The occupation is the one through which you will advance the endeavor. The endeavor “is more specific than the general occupation.” Your occupation might be information security analyst; your endeavor, a specific security problem you will work on in the United States.
EB2 NIW cybersecurity eligibility: the profession test
The intended occupation “must meet the definition of a profession”: an occupation for which a U.S. bachelor’s degree or foreign equivalent “is the minimum requirement for entry” (8 CFR 204.5(k)(2)). The Policy Manual puts the burden on you: “It is the petitioner’s burden to establish, by a preponderance of the evidence, that the intended occupation requires at least a bachelor’s degree.” It adds that this “is determined by the general requirements to enter the intended occupation, and not by the credentials of any one person.” USCIS’s EB-2 filing tips repeat it: “The occupation underlying the endeavor is determinative.”
Why the BLS wording matters for cyber roles
The Policy Manual cites the BLS Occupational Outlook Handbook as a reference for entry requirements. The handbook has no separate “cybersecurity” occupation profile; security analyst work is covered by its information security analysts profile. That profile says analysts “typically need a bachelor’s degree in computer and information technology or a related field.” It also says that “some workers enter the occupation with a high school diploma and relevant industry training and certifications.”
Many guides skip this sentence, and it is why a vague job title is risky. It does not mean cybersecurity fails the test. It means you should name the occupation that matches your work, explain why that work needs degree-level knowledge, and support it with your degree and detailed experience letters:
| If your security work mainly involves… | Closest BLS occupation | What the BLS handbook says about entry |
|---|---|---|
| Monitoring, incident response, risk assessments, security controls | Information security analysts | Typically a bachelor’s degree in computer and information technology or a related field; some enter without one |
| Original research in cryptography, intrusion detection or new security methods | Computer and information research scientists | Typically at least a master’s degree in computer science or a related field |
| Building security software, tools or secure products (AppSec, product security) | Software developers | Typically a bachelor’s degree |
| Leading security programs (security manager, CISO-type roles) | Computer and information systems managers | Bachelor’s degree plus 5 years or more of related work experience; BLS notes an IT security manager may need to have worked as an information security analyst |
Degree routes and certifications
You qualify as an advanced degree professional with a master’s degree or higher, or with a bachelor’s degree followed by five years of progressive experience in the specialty. The filing tips say that experience “must all have occurred after you obtained your degree and must relate either to the field in which you received your degree or the proposed endeavor.” Certifications do not replace a degree on this route. They do help elsewhere: “degrees, certificates, or licenses in the field” appear on the Policy Manual’s prong 2 evidence list. A “certification for a particular profession or occupation” is also one of the six exceptional ability criteria under 8 CFR 204.5(k)(3)(ii), a separate route that needs at least three of the six.
Is your cybersecurity degree a STEM degree?
The NIW rules do not define STEM, but officers “may refer to” the STEM OPT definition. The DHS STEM Designated Degree Program List (last updated July 22, 2024; check the DHS Study in the States page for the current version) includes these security-related programs:
| CIP code | Field on the DHS STEM list |
|---|---|
| 11.1003 | Computer and Information Systems Security/Auditing/Information Assurance |
| 43.0403 | Cyber/Computer Forensics and Counterterrorism |
| 29.0207 | Cyber/Electronic Operations and Warfare |
| 11.1001 | Network and System Administration/Administrator |
| 11.0701 | Computer Science |
| 14.0901 | Computer Engineering, General |
The code your school assigned matters more than the program name, and some cyber policy or management programs use codes that are not on the list. A STEM degree also does nothing by itself. The Policy Manual’s “strong positive factor” for prong 3 needs three things together: an advanced STEM degree (especially a Ph.D.), work furthering “a critical and emerging technology or other STEM area important to U.S. competitiveness,” and being well positioned to advance the endeavor.
Unsure which occupation or degree code fits your background? Request a free EB-2 NIW profile evaluation. Our petition team will review your profile and suggest how the occupation and endeavor could be framed.
Linking a cybersecurity proposed endeavor to official U.S. priorities
The Policy Manual says officers identify critical and emerging technology fields using “governmental, academic, and other authoritative and instructive sources.” For cyber, four official documents are especially useful. Cite the specific line that matches your endeavor, not the whole document.
- CISA’s critical infrastructure sectors. CISA lists 16 sectors “considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety.” They include energy, water and wastewater, healthcare and public health, financial services, communications and information technology.
- The Critical and Emerging Technologies list. Appendix A of the White House National Security Science and Technology Strategy (August 2026) has an “Information management and cybersecurity” area. Its subfields include “post-quantum cryptography,” “operational technology and industrial control system security and resilience,” “computing supply chain security and assurance” and “AI-enabled and autonomous cyber capabilities.”
- President Trump’s Cyber Strategy for America (March 2026). The strategy’s “Secure Critical Infrastructure” pillar names “the energy grid, financial and telecommunication systems, data centers, water utilities, and hospitals.” Another pillar mentions “post-quantum cryptography, zero-trust architecture, and cloud transition” for federal systems.
- Executive Order 14409 (June 2, 2026). The order directs DHS, through CISA, to issue guidance that helps agencies, state and local authorities and “operators of critical infrastructure such as rural hospitals, community banks, and local utilities” access cybersecurity tools and services.
These documents support merit and context, but they do not prove national importance by themselves. The filing tips warn that statements about “the importance of the relevant industry overall” will not satisfy the prong. The Policy Manual adds that “benefits to a specific employer alone, even an employer with a national footprint, are not sufficiently relevant.” What helps is evidence of “widespread interest in adoption or licensing of the technology.” Policy priorities change, so date-stamp what you cite.
Hypothetical weak vs. strong cybersecurity endeavors
All examples below are hypothetical, written for illustration only. They are not client cases and do not predict any outcome.
| Weak framing | Stronger hypothetical framing | Official hook | Evidence it would need |
|---|---|---|---|
| “Continue as a SOC analyst protecting my employer’s network” | Develop and share detection rules for intrusions into industrial control systems at small and mid-size water utilities | Water and Wastewater sector; OT/ICS security subfield | Use of the rules by utilities outside the employer, utility or sector-partner letters, a release plan |
| “Provide penetration testing to clients through my consulting firm” | Build and release an open tool that finds exposed medical-device network configurations in rural hospitals | Healthcare and Public Health sector; EO 14409’s reference to rural hospitals | Pilot results at more than one hospital, hospital association letters, downloads or adoption records |
| “Implement zero trust at a large bank” | Create a post-quantum cryptography migration inventory method that community banks can apply | Financial Services sector; post-quantum cryptography subfield | Interest from banks beyond the employer, conference talks, partner or regulator correspondence |
Each stronger version names a specific problem and users beyond one company. The Policy Manual’s example is direct: “a software engineer adapting their employer’s code for various clients will have difficulty demonstrating the national importance of that endeavor.” The same applies to security services sold client by client. Our EB-2 NIW guide for software engineers covers that pattern in more detail.
Evidence that works in an EB2 NIW cybersecurity petition
Prong 2 asks whether you are well positioned to advance the endeavor. The Policy Manual’s evidence list “is not meant to be a checklist,” but it warns that “unsubstantiated claims would not meet the petitioner’s burden of proof.” Security work is often under non-disclosure agreements, so plan the evidence around what you can show:
| Evidence type (Policy Manual) | How a cyber professional can document it |
|---|---|
| Degrees, certificates or licenses in the field | Transcripts, credential evaluation, industry certifications |
| Evidence of how the person’s work “is being used by others” | Published CVE records for vulnerabilities you reported (searchable in NIST’s National Vulnerability Database), open-source tools others rely on, detection content adopted by other teams |
| Published articles, media reports, or “positive discourse around, or adoption of” the work | Conference talks, published advisories, peer-reviewed or industry papers, independent coverage |
| Copies of contracts, agreements or licenses | Pilot or information-sharing agreements with outside organizations |
| Letters from government agencies or quasi-governmental entities | A letter from a public agency or a federally funded research and development center that knows your work |
| A plan describing how you will continue the work in the United States | A roadmap with partners, milestones, and how results will be shared |
When your work is confidential
- Describe outcomes, not secrets. A supervisor’s signed letter can explain the type of threat, your role and the measured result without naming systems or vulnerabilities. Agree in advance what your employer allows.
- Never include classified or export-controlled material. If your work involves a clearance, ask your security officer what can be described, and consult a licensed immigration attorney for complex situations.
- Add independent corroboration. The Policy Manual says letters are persuasive when they come from experts “who have first-hand knowledge,” give specific examples, “and are supported by other independent evidence.” A letter from a partner organization that used your work carries more weight than internal praise.
- Build a public trail now. Coordinated vulnerability disclosures, talks and open tools create evidence you can share. For more ideas, see EB-2 NIW evidence without publications.
Prong 3: why waive labor certification for a cyber professional?
The prong 3 factors include whether labor certification would be impractical, the benefit of your contributions “even if other U.S. workers were also available,” and urgency, “such as a time-sensitive public health or safety benefit offered by the endeavor.” Where the STEM strong positive factor applies, USCIS says the benefit is “especially weighty where the endeavor has the potential to support U.S. national security,” or when interested government agencies support the petition. One common argument fails alone: “evidence of a national labor shortage in the person’s occupation would not, by itself, satisfy this third prong.” The Cyber Strategy’s workforce pillar does not change that. Build prong 3 on your endeavor, not on demand for cyber talent.
Common pitfalls in cybersecurity NIW petitions
- A title instead of an occupation. “Cyber analyst” with no link to a recognized occupation that requires a degree for entry.
- Threat statistics as the argument. General attack trends show the field matters, not that your endeavor does.
- Employer-only results. Fewer incidents at one company, with no reach beyond it.
- Missing initial evidence. Since August 5, 2026, USCIS may deny a request without first issuing an RFE when required initial evidence is missing.
Frequently Asked Questions
Can a cyber analyst get a green card through the NIW without an employer?
Yes. The NIW waives the job offer and labor certification, so you can file Form I-140 yourself. You still need to meet the EB-2 threshold and all three Dhanasar prongs.
Does working in a critical infrastructure sector prove national importance?
Not by itself. A CISA sector shows the area matters. National importance depends on what your specific endeavor will do and on evidence that its effects reach beyond your employer.
Can certifications replace a degree?
Not for the advanced degree route, which needs a master’s degree or a bachelor’s plus five years of progressive experience. Certifications still count as prong 2 evidence and as one exceptional ability criterion.
Is premium processing available?
Yes, for E21 NIW petitions. Form I-907 costs $2,965 (G-1055, edition 10/16/26), and USCIS must take action within 45 business days. That action can be a request for evidence rather than a decision (USCIS premium processing page).
Skycap prepares complete I-140 petition packages for security professionals filing on their own, with installment options on our plans page. To see how your cyber work could be framed, start with a free profile evaluation.
Related guides
This article is general information, not legal advice. Skycap Consultancy is a petition-preparation consultancy, not a law firm. Requirements and fees change; check the linked USCIS pages before filing.
