Sr Specialist - Insider Threat

Your opportunity

At Charles Schwab, our purpose is simple: we champion client’s goals with passion and integrity. Guided by honesty, mutual respect and a commitment to doing what’s right, we bring innovation, education, and service together to help shape financial futures. Our people are the foundation of our success – they approach their work with curiosity and collaboration, coming together to create solutions that make a meaningful impact for clients and communities. As we expand into India, we are bringing this same culture of inclusion, learning, and opportunity to new talent. Joining us means becoming part of a global team where your work matters and your future can take shape.​

Our Hyderabad location is central to Schwab’s growth, bringing together talented people and technology to drive innovation, scale and efficiency. Here, you will work alongside teams who create solutions that support millions of clients every day. The work you do is more than daily operations – it’s a chance to experiment, learn, and build within a values-driven, supportive environment. This is a unique opportunity to be part of our early growth phase and shape something new, backed by the stability and strength of a Fortune 500 company. Your impact begins on day one, and your contributions will help define our future in the region​

​At Schwab, you’re empowered to make an impact on your career. Innovative thinking meets creative problem solving as we work to protect our clients, employees, and firm from evolving insider risks. We are expanding our Insider Threat Operations team and are seeking a skilled analyst to support the detection, investigation, and mitigation of insider risk activity.

Key Responsibilities:

• Threat Detection & Monitoring:
• Monitor insider threat tools (UEBA, SIEM, DLP, EDR) to identify anomalous or suspicious user activity.
• Triage and prioritize alerts, correlating data from multiple sources to determine risk and required action.
• Identify trends and behavioral patterns indicative of insider risk activity.
• Investigation & Analysis:
• Conduct thorough investigations into potential insider threats.
• Collect, analyze, and interpret data to develop actionable findings.
• Document investigations with clear evidence and timelines.
• Incident Response Support:
• Support the full lifecycle of insider threat incidents.
• Execute response playbooks and contribute to post-incident reviews.
• Escalate high-risk findings in accordance with policy.
• Detection Engineering & Tuning:
• Refine and optimize detection rules and alerts.
• Support development of new detection use cases.
• Partner with engineering teams to enhance analytics.
• Cross-Functional Collaboration:
• Partner with HR, Legal, and Security teams.
• Communicate findings to technical and non-technical stakeholders.
• Serve as liaison for insider threat escalations.
• Reporting & Communication:
• Prepare reports and summaries on insider threat activity.
• Provide recommendations to improve security posture.
• Maintain accurate case documentation.
• Program & Process Improvement:
• Contribute to playbooks, SOPs, and workflows.
• Identify gaps and recommend improvements.
• Support program maturity initiatives.

What you have

Required Qualifications:       

• Bachelor’s degree in Cybersecurity, IT, or related field (or equivalent experience).
• 2–5+ years of experience in cybersecurity or insider threat.
• Experience with SIEM, UEBA, DLP, or EDR tools.
• Strong analytical and data interpretation skills.
• Knowledge of networking concepts and threat actor techniques.

Preferred Qualifications:

• Experience with alert triage, incident investigations, and case management
• Familiarity with behavioral analytics and detection methodologies
• Experience working cross-functionally with HR, Legal, or Risk teams
• Strong written and verbal communication skills, including executive-ready reporting