Careers at Charles Schwab

Your opportunity

At Charles Schwab, our purpose is simple: we champion client’s goals with passion and integrity. Guided by honesty, mutual respect and a commitment to doing what’s right, we bring innovation, education, and service together to help shape financial futures. Our people are the foundation of our success – they approach their work with curiosity and collaboration, coming together to create solutions that make a meaningful impact for clients and communities. As we expand into India, we are bringing this same culture of inclusion, learning, and opportunity to new talent. Joining us means becoming part of a global team where your work matters and your future can take shape.​

Our Hyderabad location is central to Schwab’s growth, bringing together talented people and technology to drive innovation, scale and efficiency. Here, you will work alongside teams who create solutions that support millions of clients every day. The work you do is more than daily operations – it’s a chance to experiment, learn, and build within a values-driven, supportive environment. This is a unique opportunity to be part of our early growth phase and shape something new, backed by the stability and strength of a Fortune 500 company. Your impact begins on day one, and your contributions will help define our future in the region.

The SOC Manager is the leader and program manager of the Security Operations Center, responsible for overseeing the entire 24/7 SOC program from a strategic and managerial level. This role ensures that the SOC’s people, processes, and technologies work in unison to detect and respond to cybersecurity threats effectively, especially critical in a high-stakes financial environment where customer trust and regulatory compliance are paramount. The SOC Manager defines the SOC’s strategy and operating procedures, aligns the team’s objectives with the organization’s risk management and business goals, and communicates the SOC’s status and needs to executive leadership. In a financial industry context, the SOC Manager also plays a key role in ensuring compliance with industry regulations (such as PCI-DSS or FFIEC guidelines) through well-documented processes and by coordinating with risk and compliance teams.

Key Responsibilities 

• Strategic Direction: Develop and drive the SOC’s strategy and roadmap. Define the scope of the SOC’s services (e.g., which threats to monitor, which assets to protect) in alignment with the organization’s business objectives and risk appetite. Regularly assess and update this strategy to address evolving cyber threats, new business initiatives, and changes in regulatory requirements.
• Team Leadership & Development: Build and manage the SOC team to ensure 24/7 operational coverage and high performance. Oversee recruitment, training, and professional development of SOC personnel (analysts and team leads). Establish clear performance goals and career progression paths for team members, fostering a culture of continuous improvement and strong teamwork. Provide coaching and conduct performance evaluations.
• Operational Oversight: Oversee daily SOC operations and ensure the incident response program is functioning effectively at all times. Verify that the SOC is appropriately staffed, and that incident response playbooks and processes are well-documented, tested, and adhered to during incidents. Organize regular drills or simulations (like cyber incident tabletop exercises) to test and improve the team’s readiness for various attack scenarios.
• Metrics & Reporting: Define and monitor key performance indicators (KPIs) for the SOC, such as Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), incident volume trends, and analyst efficiency. Use metrics to gauge the SOC’s effectiveness and identify areas for improvement. Prepare and deliver regular reports and executive summaries highlighting the SOC’s activities, major incidents, and value delivered (e.g., threats detected and prevented) to senior management and other stakeholders. Communicate the organization’s security posture in business terms, translating technical details into risk and impact language that executives can understand.
• Process Improvement & Technology: Continuously improve SOC processes and technology stack. Champion the integration of advanced security tools and automation to streamline operations (for instance, deploying a SOAR platform to automate repetitive tasks and orchestrate incident response actions). Evaluate and implement new security monitoring solutions or threat intelligence services to enhance detection capabilities.
• Regularly review and update incident response playbooks and SOPs for efficiency and relevance.
• Cross-Functional Collaboration: Coordinate with peer teams and stakeholders across the organization. Work closely with IT infrastructure teams, application owners, compliance and legal departments, fraud investigation units, and others to ensure a unified approach to security. For example, collaborate with the Threat Intelligence team to ingest relevant threat intel into the SOC, or with Compliance/Legal in the event an incident has regulatory reporting implications. Foster strong communication channels so that the SOC is aware of upcoming changes (new systems, major business initiatives) and can adapt its monitoring appropriately.
• Risk & Compliance Management: Ensure SOC activities meet regulatory and compliance requirements. In the financial sector, this includes maintaining robust audit trails of incidents, adhering to data privacy laws, and possibly reporting certain incidents to regulators. Develop and enforce policies and procedures that align with frameworks/standards (like NIST CSF, ISO 27001) and industry regulations. Support internal and external audits by providing evidence of SOC controls and effectiveness.

What you have

Required Qualifications

• Experience: 7–10+ years of experience in cybersecurity, with several years in a leadership role managing security operations or incident response teams. A background that includes climbing the ranks (e.g., from analyst to senior/lead) is ideal, as it provides both hands-on technical experience and insight into effective SOC processes. Experience in the financial services industry or other large enterprises is highly valuable, given the scope and regulatory environment.
• Leadership & Management Skills: Proven experience in leading and developing teams. This includes setting objectives, performance management, and mentoring. The SOC Manager should have experience managing a team with 24/7 responsibilities and an understanding of how to maintain team morale and effectiveness in a high-pressure environment. Strong project management skills to drive initiatives (such as tool deployments or new process rollouts) from concept to completion.
• Technical Knowledge: Broad and deep understanding of security technologies and operations. Expertise with SIEM, EDR, and other incident response tools from an administrative/management perspective (e.g., ensuring proper deployment and health of these systems). Familiarity with network architecture, system administration, and security best practices across on-premises and cloud environments. While the SOC Manager may not be involved in day-to-day analysis, they should be capable of understanding technical issues encountered by the team and providing guidance or resources.
• Strategic and Business Acumen: Ability to develop security operations strategies that align with business needs and risk management goals. This includes knowledge of risk assessment methodologies and understanding of how cybersecurity incidents can impact business operations, finances, and reputation. The SOC Manager should be adept at justifying investments in the SOC through metrics and business cases (e.g., demonstrating how improved detection and response reduces potential financial loss).
• Certifications: Security management or leadership certifications are strongly preferred, such as CISSP (Certified Information Systems Security Professional) or CISM (Certified Information Security Manager). These indicate a solid grasp of security governance, program management, and risk management. Relevant technical certifications at the expert level (e.g., GIAC GSLC/GSED, or vendor-specific expert certifications) can also underscore the candidate’s technical credibility. An MBA or master’s degree in cybersecurity/information assurance can be a plus, reflecting further leadership and business training.

Preferred Qualifications

• Financial Industry Expertise: Prior experience working in or with financial institutions’ security operations, acknowledging the unique threat landscape (e.g., fraud, insider threats, nation-state actors) and stringent regulatory requirements (such as SOC audits, SOX, PCI, GLBA). Understanding of financial industry compliance and audit standards is extremely beneficial.
• Change Management & Scaling Experience: Demonstrated success in scaling and maturing a SOC – for instance, having expanded a team, introduced new tiers, or improved a SOC from a basic operation to an advanced one. Experience leading organizational change (new processes, technology rollouts, or restructuring) in a security context is a strong plus.
• Innovation: A track record of implementing automation, machine learning, or other innovative solutions in security operations to improve efficiency and effectiveness. For example, deploying a new SOAR system or integrating advanced analytics into the SOC workflow.
• Stakeholder Engagement: Proven ability to work with and present to senior leadership (CISO, CIO, risk officers) and potentially external regulators or auditors. Comfort in providing assurance about the organization’s security posture and justifying SOC needs (budget, staffing) at the executive level.