Security Development Automation Lead Engineer

Your Opportunity

Schwab remains committed to providing increased visibility to career growth opportunities and job requirements. This posting announcement is part of increased transparency and while all qualified applicants will be reviewed and considered, this organization has a preferred candidate identified for this role. 

Your Opportunity: The Schwab Cybersecurity Services (SCS) organization is a centralized Center of Excellence (COE) within Schwab Technology Services (SCS) that provides security services to advance Schwab’s security posture of critical assets. The Schwab Cybersecurity Services (SCS) organization is a centralized Center of Excellence (COE) within Schwab Technology Services (STS) that provides security services to advance Schwab’s security posture of critical assets.

Automation Engineering team within SCS Application and Data Engineering organization owns the strategy, design, development, implementation and support through automation and orchestration for achieving high security and performance, increasing efficiency, and eliminating manual repetitive tasks in cyber operations and business process within SCS. We are looking for a strong and talented Security Development and Automation Engineer as technical lead for SOAR AI security development.

Role Summary

As the SOAR Development Lead Engineer, you will design, develop, and optimize advanced Security Orchestration, Automation, and Response (SOAR) capabilities to strengthen enterprise security operations. This role blends deep technical expertise in SOAR architecture with leadership to deliver scalable automation solutions and drive innovation through AI-powered security features for the NextGen SOC.

What you are good at:
• Architecting and maintaining SOAR platforms, including data ingestion, connectors, playbooks, 
and integration frameworks, ensuring continuous operational excellence 
• Developing automation workflows to streamline alert enrichment, case management, and 
containment
• Ensuring platform scalability and reliability through robust design and proactive monitoring 
• Integrating SOAR with SIEM and other security tools for seamless orchestration 
• Collaborating with SOC, SIEM, and Cyber Defense teams to validate data flows and maintain 
operational readiness 
• Applying AI and machine learning concepts to enhance SOC automation and threat detection, 
leveraging advanced technologies 
• Designing and developing secure log ingestion pipelines, ensuring accurate parsing, 
normalization, and enrichment for SIEM analysis 
• Mentoring junior engineers and providing subject matter expertise on SOAR best practices 
• Partnering with cross-functional teams to align automation strategies with organizational goals
• Analyzing diverse problems, requiring evaluation of specific factors and data 
• Applying advanced expertise in implementing security controls and technologies 
• Developing and delivering solutions using Agile methodology

What you have

Required Qualifications
• Bachelor’s degree in computerscience or related field (preferred).
• 12+ years of overall cybersecurity experience.
• 10+ years in security engineering, with a focus on automation and orchestration.
• Deep proficiency in cloud service implementation, preferably Google Cloud Platform (GCP).
• Strong programming skills in Python for scripting, automation, and API integrations.
• Experience designing SOAR integrations including, connectors, playbooks, and event‑driven 
or API‑driven automation frameworks
• Ability to analyze security event data, troubleshoot complex log source issues, and fine-tune 
detection logic.
• Adaptability to dynamic, fast-paced team environments.
• Exposure and strong interest in cloud AI/ML framework
• Excellent communication, collaboration, and critical thinking skills