Endpoint Data Loss Prevention Lead

Vanguard; Malvern (Chester County); Hybrid; USD 140,000 - 190,000; Full time

Job summary

Vanguard is seeking an experienced information security professional in Malvern, PA with hybrid options across Charlotte, NC or Dallas, TX. You will lead the migration from legacy endpoint DLP agents to cloud-delivered protection, design end-user notification workflows, and build automation via REST APIs and SIEM pipelines.

You will report metrics to leadership, evaluate new data security technologies, mentor junior engineers, and collaborate on cross-team initiatives in a dynamic, regulated

Qualifications

• 8+ years in information security with hands-on endpoint DLP engineering.
• Bachelor's degree in Cybersecurity, IT, CS, or related field; equivalent experience.
• Deep hands-on with Zscaler Endpoint DLP including Client Connector and endpoint policy.
• Hands-on with Digital Guardian: policy, agent deployment, and incident workflows.
• Experience leading enterprise-scale endpoint security migrations.
• 4+ years scripting (Python, PowerShell, Shell) for policy management and automation.
• 3+ years working with SIEMs (Elastic, Splunk) for endpoint DLP analysis.
• Proficiency in JIRA, Confluence, ServiceNow, and Agile/Scrum.

Responsibilities

• Leads migration from legacy endpoint DLP agents to cloud-delivered DLP platforms.
• Designs EUN workflows balancing control and user productivity.
• Builds automation via REST APIs, SIEM/SOAR pipelines, and CI/CD.
• Defines and reports program metrics to security leadership.
• Evaluates emerging data security technologies.
• Mentors engineers and leads knowledge transfer.
• Participates in special projects as assigned.

Skills

Autonomy in ambiguity

Technical risk communication

Influence across boundaries

User-centric balance

Education

Bachelor's degree in Cybersecurity, IT, CS, or related field

Tools

Zscaler Endpoint DLP

Zscaler Client Connector

Digital Guardian

JIRA

Confluence

ServiceNow

Job description

This Hybrid Role (in office Tues-Wed-Thurs) is based in Malvern, PA (HQ), Charlotte, NC or Dallas, TX.

Core Responsibilities

• Leads the technical migration from legacy endpoint DLP agents (e.g., Digital Guardian) to cloud-delivered endpoint protection platforms (e.g., Zscaler Client Connector / Zscaler Endpoint DLP), including agent coexistence strategy, policy parity mapping, and phased cutover.
• Designs and enforces end-user notification (EUN), coaching, and justification workflows that balance control effectiveness against user friction and productivity impact.
• Builds automation and integrations via REST APIs, SIEM/SOAR pipelines, and CI/CD to reduce manual effort in policy deployment, incident enrichment, and reporting.
• Defines and reports program metrics - coverage, detection efficacy, false positive rate, mean time to triage, and policy drift - to security leadership.
• Evaluates emerging data security technologies.
• Mentors junior engineers and analysts, builds team technical depth, and leads knowledge transfer and cross-training initiatives.
• Participates in special projects and performs other duties as assigned.

Qualifications – Required

• Minimum 8 years in information security, with at least 5 years of hands-on endpoint DLP engineering and operations.
• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field; equivalent professional experience considered.
• Deep hands-on expertise with Zscaler Endpoint DLP (ZDP) / Zscaler Data Protection , including Zscaler Client Connector, forwarding profiles, and endpoint policy configuration.
• Hands-on expertise with Digital Guardian , including DGMC policy and rule authoring, agent deployment and upgrade management, control set design, and incident workflow administration.
• Demonstrated experience leading an endpoint security agent migration or consolidation at enterprise scale.
• 4+ years of scripting and automation experience (Python, PowerShell, Shell) for endpoint policy management, reporting, and API-driven integration.
• 3+ years working with security telemetry and SIEM platforms (Elastic, Splunk, or equivalent) for endpoint DLP incident analysis and reporting.
• Proficiency in JIRA, Confluence, ServiceNow, and Agile/Scrum delivery.

Qualifications – Preferred

• Experience with Microsoft Purview Information Protection, sensitivity labeling, and Microsoft 365 oversharing remediation.
• Experience implementing data controls for GenAI and LLM usage, including prompt and upload inspection.
• Familiarity with UEBA and insider risk analytics platforms.
• Industry certifications: CISSP, CCSP, GCFA, GCED, or vendor certifications in Zscaler (ZDTA, ZCCP-DP) or Digital Guardian.
• Experience supporting regulatory examination and audit evidence production in a financial services or other highly regulated environment.

Competencies

• Operates with autonomy in ambiguity; translates emerging data risks into actionable control requirements.
• Communicates technical risk clearly to non-technical and executive audiences.
• Influences across organizational boundaries without direct authority.
• Balances control rigor against business enablement and user experience.

Special Factors

Sponsorship

Vanguard is not offering visa sponsorship for this position.

About Vanguard

At Vanguard, we don't just have a mission-we're on a mission.

To work for the long-term financial wellbeing of our clients. To lead through product and services that transform our clients' lives. To learn and develop our skills as individuals and as a team. From Malvern to Melbourne, our mission drives us forward and inspires us to be our best.

How We Work

Vanguard has implemented a hybrid working model for the majority of our crew members, designed to capture the benefits of enhanced flexibility while enabling in-person learning, collaboration, and connection. We believe our mission-driven and highly collaborative culture is a critical enabler to support long-term client outcomes and enrich the employee experience.