Penetration Test Program Manager

Your Opportunity

At Schwab, you're empowered to make an impact on your career. Here, innovative thought meets creative problem solving, helping us "challenge the status quo" and transform the finance industry together.

We believe in the importance of in-office collaboration and fully intend for the selected candidate for this role to work on site in the specified location.

As Schwab continues to expand its technology footprint across cloud, artificial intelligence, digital platforms, applications & APIs, and infrastructure services, the Technology Risk Management (TRM) team plays a critical role in helping ensure the company maintains a strong risk posture through independent oversight and risk-informed assurance activities. Within TRM, the Penetration Testing team provides independent penetration testing and challenge of security controls through a combination of internal and vendor-led penetration testing activities designed to identify vulnerabilities, validate defensive capabilities, and strengthen the firm's overall risk posture.

In this highly visible individual contributor role, you will serve as a central coordinator and risk management partner supporting the administration, execution, governance, reporting, and continuous improvement of the penetration testing program. You will work closely with penetration testers, technology teams, cybersecurity partners, application developers, risk managers, and external vendors to ensure testing activities are planned, executed, documented, and reported effectively.

You will help facilitate testing engagements across applications & APIs, infrastructure & cloud environments, AI solutions, and emerging technologies while ensuring alignment with Schwab policies, standards, regulatory requirements, and industry best practices.

Success in this role comes from balancing strong program management, analytical thinking, communication skills, and risk management expertise. You will help identify systemic risks, recurring vulnerabilities, and control weaknesses across testing activities while providing leadership with meaningful insights to understand the broader risk implications and trends impacting the organization. Through thematic analysis, executive reporting, stakeholder engagement, and continuous process improvement, your expertise will help strengthen governance, improve risk visibility, and enhance the overall maturity and effectiveness of the penetration testing program.

Your work will directly contribute to informed decision-making, stronger control environments, improved remediation outcomes, and the ongoing evolution of Schwab's risk capabilities.

To ensure that we have fulfilled our promise of "challenging the status quo," this role has specific qualifications that successful candidates should have.

• Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Technology, Business, Risk Management, or a related field
• 5+ years of experience in Cybersecurity, Technology Risk Management, Information Security, Governance, Risk and Compliance, Program Management, or related disciplines
• Experience supporting, coordinating, facilitating, or managing complex initiatives, penetration testing programs, or security assurance initiatives
• Strong analytical skills with the ability to identify trends, systemic issues, emerging risks, and control weaknesses
• Strong communication skills with the ability to present technical and risk information to both technical and non-technical audiences
• Experience developing reports, dashboards, metrics, presentations, and executive briefings
• Ability to manage multiple priorities and coordinate activities across numerous stakeholders and teams
• Experience working in highly regulated environments with strong governance and documentation requirements
• Ability to develop collaborative relationships across cybersecurity, technology, risk management, and business organizations

• Experience reviewing security findings, vulnerability assessments, penetration testing results, or technology risk assessments
• Knowledge of cybersecurity and risk management frameworks including NIST Cybersecurity Framework (CSF), NIST 800-53, NIST 800-115, FFIEC guidance, PCI DSS, or similar standards
• Professional certifications such as CISSP, CISM, CRISC, CISA, Security+, CCSK, CGRC, PMP, or similar credentials
• Experience supporting penetration testing, vulnerability management, red team, application security,…