Careers at Charles Schwab

Your opportunity

At Charles Schwab, our purpose is simple: we champion client’s goals with passion and integrity. Guided by honesty, mutual respect and a commitment to doing what’s right, we bring innovation, education, and service together to help shape financial futures. Our people are the foundation of our success – they approach their work with curiosity and collaboration, coming together to create solutions that make a meaningful impact for clients and communities. As we expand into India, we are bringing this same culture of inclusion, learning, and opportunity to new talent. Joining us means becoming part of a global team where your work matters and your future can take shape.​

Our Hyderabad location is central to Schwab’s growth, bringing together talented people and technology to drive innovation, scale and efficiency. Here, you will work alongside teams who create solutions that support millions of clients every day. The work you do is more than daily operations – it’s a chance to experiment, learn, and build within a values-driven, supportive environment. This is a unique opportunity to be part of our early growth phase and shape something new, backed by the stability and strength of a Fortune 500 company. Your impact begins on day one, and your contributions will help define our future in the region

Key Responsibilities :

• Successful candidates will have prior engineering experience within a Software Security Assurance or Application Security teams and a proven ability to partner effectively with development teams to balance security requirements with innovation.
• They will demonstrate strong analytical skills, including the ability to interpret large volumes of distributed data and translate it into clear, actionable insights.
• Candidates should also have experience working with a range of application security tools, including Software Composition Analysis (SCA), Static Application Security Testing (SAST), and secrets management solutions.
• In addition, candidates will bring solid application engineering experience and a strong understanding of common application vulnerabilities, attack vectors, and remediation strategies.
• They should be familiar with secure software design principles and industry best practices for integrating security into the software development lifecycle.
• Experience with enterprise application security testing tools and their integration into agile development environments for CI/CD is expected.

What you have

Required Qualifications:

• Candidates should have familiarity with recognized industry frameworks and standards such as OWASP, CIS, and NIST.
• A minimum of two years of experience working with static analysis or threat modeling tools is expected, along with experience implementing and scaling enterprise application security tools, services, and controls.
• Finally, candidates must demonstrate a strong understanding of secure coding practices, manual code review processes, threat modeling models, security requirements analysis, and architectural risk assessment. \
• Bachelor’s degree in computer science or related field.
• Ability to demonstrate knowledge of OWASP Top 10 and CWE Top 25.
• Knowledge of application-layer security controls, including authentication and authorization methods, input/output validation and sanitization, and defenses against attacks such as cross-site scripting or command injection.
• Perform manual secure code reviews independent of automated tooling by identifying security flaws, insecure design patterns, abuse cases, and business logic weaknesses across application code destined for production environments.
• Understanding of secure cryptographic practices, including appropriate use of encryption algorithms, hashing functions, and protection of data at rest and in motion.
• Secure coding in Java or .NET web and service development, backed by hands-on programming and IT experience.
• Experience participating as a member of a team in an agile environment.
• Experience with the Secure Development Lifecycle.
• Experience with security tools including SAST, DAST, IDE plugins, decompilers, and threat modeling platforms.
• Experience with source code repository tools such as BitBucket and GitHub.
• Web application penetration testing, ethical hacking, red/blue teaming, or capture-the-flag experience a plus. 

Preferred Qualifications

• Python Automation & API Integration 
  Strong proficiency in designing Python‑based automation for large‑scale REST API integrations, including repository management, content discovery, workflow orchestration, and encoded file handling across enterprise source‑control platforms.
• Custom CodeQL Query Development 
  Strong understanding of CodeQL query authoring concepts, including QL pack management, database creation, dependency resolution via --search-path, and techniques for minimizing false positives through boundary analysis and source/sink filtering.
• GitHub Advanced Security (GHAS) Platform Engineering 
  Deep familiarity with GitHub Advanced Security capabilities, including Code Scanning, Secret Scanning, Dependency Review, custom query configuration, and scalable alert triage and remediation workflows across multiple repositories.
• CI/CD Pipeline Architecture (GitHub Actions) 
  Demonstrated expertise in architecting reusable and scalable CI/CD workflows using GitHub Actions, including callable workflows, matrix strategies, cross‑repository authentication models, and centralized pipeline governance.
• SARIF Output Analysis & Interpretation 
  Strong knowledge of the SARIF specification and its use in static analysis pipelines, including interpreting results, validating findings, identifying false positives, and enabling automated reporting across diverse codebases.
• Enterprise Git Workflow & Release Management 
  Experience designing and governing enterprise Git workflows, including structured branching strategies, release coordination, branch protection rules, cross‑organization pull requests, and versioning policy enforcement.
• Application Security Vulnerability Engineering 
  Solid understanding of common software weakness classes and the intentional design of vulnerable code patterns to validate static analysis coverage, detection accuracy, and severity classification.
• Multi‑Repository Architecture & Configuration Delivery 
  Proven ability to architect centralized configuration and workflow distribution models for large repository ecosystems, including reusable workflows, configuration validation, and scalable authentication mechanisms.
• Enterprise Package Registry & Dependency Governance 
  Strong knowledge of internal package ecosystems and dependency governance, including artifact repository configuration, registry enforcement and blocking strategies, and controlled use of vulnerable dependencies for security testing.
• Technical Documentation & Architecture Decision Records 
  Excellent written communication skills with experience producing high‑quality technical documentation, including Architecture Decision Records (ADRs), onboarding guides, and operational runbooks for cross‑functional engineering teams