Endpoint Data Loss Prevention Lead

This Hybrid Role (in office Tues-Wed-Thurs) is based in Malvern, PA (HQ), Charlotte, NC or Dallas, TX.

Core Responsibilities:

• Leads the technical migration from legacy endpoint DLP agents (e.g., Digital Guardian) to cloud-delivered endpoint protection platforms (e.g., Zscaler Client Connector / Zscaler Endpoint DLP), including agent coexistence strategy, policy parity mapping, and phased cutover.
• Designs and enforces end-user notification (EUN), coaching, and justification workflows that balance control effectiveness against user friction and productivity impact.
• Builds automation and integrations via REST APIs, SIEM/SOAR pipelines, and CI/CD to reduce manual effort in policy deployment, incident enrichment, and reporting.
• Defines and reports program metrics - coverage, detection efficacy, false positive rate, mean time to triage, and policy drift - to security leadership.
• Evaluates emerging data security technologies.
• Mentors junior engineers and analysts, builds team technical depth, and leads knowledge transfer and cross-training initiatives.
• Participates in special projects and performs other duties as assigned.

• Minimum 8 years in information security, with at least 5 years of hands-on endpoint DLP engineering and operations.
• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field; equivalent professional experience considered.
• Deep hands-on expertise with Zscaler Endpoint DLP (ZDP) / Zscaler Data Protection, including Zscaler Client Connector, forwarding profiles, and endpoint policy configuration.
• Hands-on expertise with Digital Guardian, including DGMC policy and rule authoring, agent deployment and upgrade management, control set design, and incident workflow administration.
• Demonstrated experience leading an endpoint security agent migration or consolidation at enterprise scale.
• 4+ years of scripting and automation experience (Python, PowerShell, Shell) for endpoint policy management, reporting, and API-driven integration.
• 3+ years working with security telemetry and SIEM platforms (Elastic, Splunk, or equivalent) for endpoint DLP incident analysis and reporting.
• Proficiency in JIRA, Confluence, ServiceNow, and Agile/Scrum delivery.

• Experience with Microsoft Purview Information Protection, sensitivity labeling, and Microsoft 365 oversharing remediation.
• Experience implementing data controls for GenAI and LLM usage, including prompt and upload inspection.
• Familiarity with UEBA and insider risk analytics platforms.
• Industry certifications: CISSP, CCSP, GCFA, GCED, or vendor certifications in Zscaler (ZDTA, ZCCP-DP) or Digital Guardian.
• Experience supporting regulatory examination and audit evidence production in a financial services or other highly regulated environment.

• Operates with autonomy in ambiguity; translates emerging data risks into actionable control requirements.
• Communicates technical risk clearly to non-technical and executive audiences.
• Influences across organizational boundaries without direct authority.
• Balances control rigor against business enablement and user experience.