Endpoint Data Loss Prevention Lead

This Hybrid Role (in office Tues-Wed-Thurs) is based in Malvern, PA (HQ), Charlotte, NC or Dallas, TX.
Core Responsibilities:
Leads the technical migration from legacy endpoint DLP agents (e.g., Digital Guardian) to cloud-delivered endpoint protection platforms (e.g., Zscaler Client Connector / Zscaler Endpoint DLP), including agent coexistence strategy, policy parity mapping, and phased cutover.
Designs and enforces end-user notification (EUN), coaching, and justification workflows that balance control effectiveness against user friction and productivity impact.
Builds automation and integrations via REST APIs, SIEM/SOAR pipelines, and CI/CD to reduce manual effort in policy deployment, incident enrichment, and reporting.
Defines and reports program metrics — coverage, detection efficacy, false positive rate, mean time to triage, and policy drift — to security leadership.
Evaluates emerging data security technologies.
Mentors junior engineers and analysts, builds team technical depth, and leads knowledge transfer and cross-training initiatives.
Participates in special projects and performs other duties as assigned.
Qualifications:
Required
Minimum 8 years in information security, with at least 5 years of hands-on endpoint DLP engineering and operations.
Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field; equivalent professional experience considered.
Deep hands-on expertise with Zscaler Endpoint DLP (ZDP) / Zscaler Data Protection, including Zscaler Client Connector, forwarding profiles, and endpoint policy configuration.
Hands-on expertise with Digital Guardian, including DGMC policy and rule authoring, agent deployment and upgrade management, control set design, and incident workflow administration.
Demonstrated experience leading an endpoint security agent migration or consolidation at enterprise scale.
4+ years of scripting and automation experience (Python, PowerShell, Shell) for endpoint policy management, reporting, and API-driven integration.
3+ years working with security telemetry and SIEM platforms (Elastic, Splunk, or equivalent) for endpoint DLP incident analysis and reporting.
Proficiency in JIRA, Confluence, ServiceNow, and Agile/Scrum delivery.
Preferred
Experience with Microsoft Purview Information Protection, sensitivity labeling, and Microsoft 365 oversharing remediation.
Experience implementing data controls for GenAI and LLM usage, including prompt and upload inspection.
Familiarity with UEBA and insider risk analytics platforms.
Industry certifications: CISSP, CCSP, GCFA, GCED, or vendor certifications in Zscaler (ZDTA, ZCCP-DP) or Digital Guardian.
Experience supporting regulatory examination and audit evidence production in a financial services or other highly regulated environment.
Competencies:
Operates with autonomy in ambiguity; translates emerging data risks into actionable control requirements.
Communicates technical risk clearly to non-technical and executive audiences.
Influences across organizational boundaries without direct authority.
Balances control rigor against business enablement and user experience.
Special Factors
Sponsorship
Vanguard is not offering visa sponsorship for this position.
About Vanguard
At Vanguard, we don't just have a mission—we're on a mission.
To work for the long-term financial wellbeing of our clients. To lead through product and services that transform our clients' lives. To learn and develop our skills as individuals and as a team. From Malvern to Melbourne, our mission drives us forward and inspires us to be our best.
How We Work
Vanguard has implemented a hybrid working model for the majority of our crew members, designed to capture the benefits of enhanced flexibility while enabling in-person learning, collaboration, and connection. We believe our mission-driven and highly collaborative culture is a critical enabler to support long-term client outcomes and enrich the employee experience.