This Hybrid Role (in office Tues-Wed-Thurs) is based in Malvern, PA (HQ), Charlotte, NC or Dallas, TX.
Core Responsibilities:
- Leads the technical migration from legacy endpoint DLP agents (e.g., Digital Guardian) to cloud-delivered endpoint protection platforms (e.g., Zscaler Client Connector / Zscaler Endpoint DLP), including agent coexistence strategy, policy parity mapping, and phased cutover.
- Designs and enforces end-user notification (EUN), coaching, and justification workflows that balance control effectiveness against user friction and productivity impact.
- Builds automation and integrations via REST APIs, SIEM/SOAR pipelines, and CI/CD to reduce manual effort in policy deployment, incident enrichment, and reporting.
- Defines and reports program metrics — coverage, detection efficacy, false positive rate, mean time to triage, and policy drift — to security leadership.
- Evaluates emerging data security technologies.
- Mentors junior engineers and analysts, builds team technical depth, and leads knowledge transfer and cross-training initiatives.
- Participates in special projects and performs other duties as assigned.
Qualifications:
Required
- Minimum 8 years in information security, with at least 5 years of hands-on endpoint DLP engineering and operations.
- Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field; equivalent professional experience considered.
- Deep hands-on expertise with Zscaler Endpoint DLP (ZDP) / Zscaler Data Protection, including Zscaler Client Connector, forwarding profiles, and endpoint policy configuration.
- Hands-on expertise with Digital Guardian, including DGMC policy and rule authoring, agent deployment and upgrade management, control set design, and incident workflow administration.
- Demonstrated experience leading an endpoint security agent migration or consolidation at enterprise scale.
- 4+ years of scripting and automation experience (Python, PowerShell, Shell) for endpoint policy management, reporting, and API-driven integration.
- 3+ years working with security telemetry and SIEM platforms (Elastic, Splunk, or equivalent) for endpoint DLP incident analysis and reporting.
- Proficiency in JIRA, Confluence, ServiceNow, and Agile/Scrum delivery.
Preferred
- Experience with Microsoft Purview Information Protection, sensitivity labeling, and Microsoft 365 oversharing remediation.
- Experience implementing data controls for GenAI and LLM usage, including prompt and upload inspection.
- Familiarity with UEBA and insider risk analytics platforms.
- Industry certifications: CISSP, CCSP, GCFA, GCED, or vendor certifications in Zscaler (ZDTA, ZCCP-DP) or Digital Guardian.
- Experience supporting regulatory examination and audit evidence production in a financial services or other highly regulated environment.
Competencies:
- Operates with autonomy in ambiguity; translates emerging data risks into actionable control requirements.
- Communicates technical risk clearly to non-technical and executive audiences.
- Influences across organizational boundaries without direct authority.
- Balances control rigor against business enablement and user experience.
Special Factors
Sponsorship
Vanguard is not offering visa sponsorship for this position.
About Vanguard
At Vanguard, we don't just have a mission—we're on a mission.
To work for the long-term financial wellbeing of our clients. To lead through product and services that transform our clients' lives. To learn and develop our skills as individuals and as a team. From Malvern to Melbourne, our mission drives us forward and inspires us to be our best.
How We Work
Vanguard has implemented a hybrid working model for the majority of our crew members, designed to capture the benefits of enhanced flexibility while enabling in-person learning, collaboration, and connection. We believe our mission-driven and highly collaborative culture is a critical enabler to support long-term client outcomes and enrich the employee experience.