Endpoint Data Loss Prevention Lead

The Vanguard Group • Charlotte, PA

3d • Hybrid

About The Position

The Endpoint Data Loss Prevention Lead drives enterprise endpoint DLP engineering and operations, including migration from legacy endpoint DLP agents such as Digital Guardian to cloud-delivered endpoint protection platforms such as Zscaler Client Connector and Zscaler Endpoint DLP. The role plans agent coexistence, maps policy parity, and leads phased cutovers. It also designs end-user notification, coaching, and justification workflows that balance security controls with user productivity.

The role builds automation and integrations using REST APIs, SIEM/SOAR pipelines, and CI/CD to reduce manual effort in policy deployment, incident enrichment, and reporting. It defines and reports program metrics—including coverage, detection efficacy, false positive rate, mean time to triage, and policy drift—to security leadership, and evaluates emerging data security technologies.

The lead mentors junior engineers and analysts, strengthens team technical capabilities, and leads knowledge transfer and cross-training. The position also participates in special projects and performs other duties as assigned. It is a hybrid role based in Malvern, Pennsylvania; Charlotte, North Carolina; or Dallas, Texas, with in-office work Tuesday through Thursday.

Requirements

• At least 8 years of experience in information security, including at least 5 years of hands-on endpoint DLP engineering and operations.
• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field; equivalent professional experience is considered.
• Deep hands-on expertise with Zscaler Endpoint DLP (ZDP) / Zscaler Data Protection, including Zscaler Client Connector, forwarding profiles, and endpoint policy configuration.
• Hands-on expertise with Digital Guardian, including DGMC policy and rule authoring, agent deployment and upgrade management, control set design, and incident workflow administration.
• Demonstrated experience leading an enterprise-scale endpoint security agent migration or consolidation.
• At least 4 years of scripting and automation experience with Python, PowerShell, or Shell for endpoint policy management, reporting, and API-driven integration.
• At least 3 years of experience with security telemetry and SIEM platforms such as Elastic, Splunk, or equivalent for endpoint DLP incident analysis and reporting.
• Proficiency in JIRA, Confluence, ServiceNow, and Agile/Scrum delivery.
• Ability to operate autonomously amid ambiguity and translate emerging data risks into actionable control requirements.
• Ability to communicate technical risk clearly to non-technical and executive audiences.
• Ability to influence across organizational boundaries without direct authority.
• Ability to balance control rigor with business enablement and user experience.

Nice To Haves

• Experience with Microsoft Purview Information Protection, sensitivity labeling, and Microsoft 365 oversharing remediation.
• Experience implementing data controls for GenAI and LLM usage, including prompt and upload inspection.
• Familiarity with UEBA and insider risk analytics platforms.
• Certifications such as CISSP, CCSP, GCFA, GCED, Zscaler ZDTA or ZCCP-DP, or Digital Guardian vendor certifications.
• Experience supporting regulatory examinations and audit evidence production in financial services or another highly regulated environment.

Responsibilities

• Lead migration from legacy endpoint DLP agents to cloud-delivered endpoint protection platforms, including coexistence strategy, policy parity mapping, and phased cutover.
• Design and enforce end-user notification, coaching, and justification workflows that balance control effectiveness with user friction and productivity.
• Build automation and integrations through REST APIs, SIEM/SOAR pipelines, and CI/CD for policy deployment, incident enrichment, and reporting.
• Define and report program metrics, including coverage, detection efficacy, false positive rate, mean time to triage, and policy drift, to security leadership.
• Evaluate emerging data security technologies.
• Mentor junior engineers and analysts, build team technical depth, and lead knowledge transfer and cross-training initiatives.
• Participate in special projects and perform other duties as assigned.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior