Endpoint Data Loss Prevention Lead

This Hybrid Role (in office Tues-Wed-Thurs) is based in Malvern PA (HQ) Charlotte NC or Dallas TX.

Core Responsibilities:

• Leads the technical migration from legacy endpoint DLP agents (e.g. Digital Guardian) to cloud-delivered endpoint protection platforms (e.g. Zscaler Client Connector / Zscaler Endpoint DLP) including agent coexistence strategy policy parity mapping and phased cutover.
• Designs and enforces end-user notification (EUN) coaching and justification workflows that balance control effectiveness against user friction and productivity impact.
• Builds automation and integrations via REST APIs SIEM/SOAR pipelines and CI/CD to reduce manual effort in policy deployment incident enrichment and reporting.
• Defines and reports program metrics coverage detection efficacy false positive rate mean time to triage and policy drift to security leadership.
• Evaluates emerging data security technologies.
• Mentors junior engineers and analysts builds team technical depth and leads knowledge transfer and cross-training initiatives.
• Participates in special projects and performs other duties as assigned.

Qualifications:

Required

• Minimum 8 years in information security with at least 5 years of hands-on endpoint DLP engineering and operations.
• Bachelors degree in Cybersecurity Information Technology Computer Science or a related field; equivalent professional experience considered.
• Deep hands-on expertise with Zscaler Endpoint DLP (ZDP) / Zscaler Data Protection including Zscaler Client Connector forwarding profiles and endpoint policy configuration.
• Hands-on expertise with Digital Guardian including DGMC policy and rule authoring agent deployment and upgrade management control set design and incident workflow administration.
• Demonstrated experience leading an endpoint security agent migration or consolidation at enterprise scale.
• 4 years of scripting and automation experience (Python PowerShell Shell) for endpoint policy management reporting and API-driven integration.
• 3 years working with security telemetry and SIEM platforms (Elastic Splunk or equivalent) for endpoint DLP incident analysis and reporting.
• Proficiency in JIRA Confluence ServiceNow and Agile/Scrum delivery.

Preferred

• Experience with Microsoft Purview Information Protection sensitivity labeling and Microsoft 365 oversharing remediation.
• Experience implementing data controls for GenAI and LLM usage including prompt and upload inspection.
• Familiarity with UEBA and insider risk analytics platforms.
• Industry certifications: CISSP CCSP GCFA GCED or vendor certifications in Zscaler (ZDTA ZCCP-DP) or Digital Guardian.
• Experience supporting regulatory examination and audit evidence production in a financial services or other highly regulated environment.

Competencies:

• Operates with autonomy in ambiguity; translates emerging data risks into actionable control requirements.
• Communicates technical risk clearly to non-technical and executive audiences.
• Influences across organizational boundaries without direct authority.
• Balances control rigor against business enablement and user experience.

Special Factors

Sponsorship

About Vanguard

At Vanguard we dont just have a missionwere on a mission.

To work for the long-term financial wellbeing of our clients. To lead through product and services that transform our clients lives. To learn and develop our skills as individuals and as a team. From Malvern to Melbourne our mission drives us forward and inspires us to be our best.

How We Work

Vanguard has implemented a hybrid working model for the majority of our crew members designed to capture the benefits of enhanced flexibility while enabling in-person learning collaboration and connection. We believe our mission-driven and highly collaborative culture is a critical enabler to support long-term client outcomes and enrich the employee experience.