Sr Specialist - Security Development & Engineering

Your Opportunity

Schwab remains committed to providing increased visibility to career growth opportunities and job requirements. This posting announcement is part of increased transparency and while all qualified applicants will be reviewed and considered, this organization has a preferred candidate identified for this role.

At Schwab, you’re empowered to make an impact on your career. Here, innovative thought meets creative problem solving, helping us “challenge the status quo” and transform the finance industry together.

We believe in the importance of in-office collaboration and fully intend for the selected candidate for this role to work on site in the specified location.

Threat Detection & Monitoring

• Monitor insider threat tools (UEBA, SIEM, DLP, EDR) to identify anomalous or suspicious user activity.
• Triage and prioritize alerts, correlating data from multiple sources to determine risk and required action.
• Identify trends and behavioral patterns indicative of insider risk activity.

Investigation & Analysis

• Conduct thorough investigations into potential insider threats.
• Collect, analyze, and interpret data to develop actionable findings.
• Document investigations with clear evidence and timelines.

Incident Response Support

• Support the full lifecycle of insider threat incidents.
• Execute response playbooks and contribute to post-incident reviews.
• Escalate high-risk findings in accordance with policy.

Detection Engineering & Tuning

• Refine and optimize detection rules and alerts.
• Support development of new detection use cases.
• Partner with engineering teams to enhance analytics.

Cross-Functional Collaboration

• Partner with HR, Legal, and Security teams.
• Communicate findings to technical and non-technical stakeholders.
• Serve as liaison for insider threat escalations.

Reporting & Communication

• Prepare reports and summaries on insider threat activity.
• Provide recommendations to improve security posture.
• Maintain accurate case documentation.

Program & Process Improvement

• Contribute to playbooks, SOPs, and workflows.
• Identify gaps and recommend improvements.
• Support program maturity initiatives.

What you have

To ensure that we have fulfilled our promise of "challenging the status quo," this role has specific qualifications that successful candidates should have.

Required Qualifications

Bachelor’s degree in Cybersecurity, IT, or related field (or equivalent experience).

2–5+ years of experience in cybersecurity or insider threat.

Experience with SIEM, UEBA, DLP, or EDR tools.

Strong analytical and data interpretation skills.

Knowledge of networking concepts and threat actor techniques.

Preferred Qualifications

​​Experience with alert triage, incident investigations, and case management
Familiarity with behavioral analytics and detection methodologies
Experience working cross-functionally with HR, Legal, or Risk teams
Strong written and verbal communication skills, including executive-ready reporting​

In addition to the salary range, this role is also eligible for bonus or incentive opportunities