Senior Cybersecurity Analyst, Third‑Party Risk

It's fun to work in a company where people truly believe in what they are doing. At Dutch Bros Coffee, we are more than just a coffee company. We are a fun-loving, mind-blowing company that makes a difference one cup at a time. 

Position Overview:

Third-party cyber risk is the top cybersecurity risk at Dutch Bros, and this role exists to own it. The Senior Cybersecurity Analyst, Third-Party Risk is a senior individual contributor and the company’s subject matter expert and thought leader for third-party risk within the Governance, Risk, and Compliance (GRC) team. This person sets the direction for the Third-Party Risk Management (TPRM) program and takes it well beyond questionnaires: building real security partnerships with the critical vendors that power our shops, app, and payments; validating controls with tangible evidence; and making sure Dutch Bros and its vendors are ready to respond together when an incident hits. The role leads third-party incident response planning and coordination across vendors and internal teams, advises senior leadership on vendor risk decisions, and raises the bar for how the business selects, onboards, and manages its vendors.

Key Result Areas: 

• TPRM Strategy & Thought Leadership: Set the multi-year vision and roadmap for the TPRM program, aligned to business priorities and risk appetite. Author and maintain the third-party security policy, standards, and operating model. Serve as the company’s go-to expert on third-party cyber risk, bringing an outside-in view through peer benchmarking and industry groups, and shaping how leadership thinks about and invests in vendor risk. Bring in tooling, automation, and AI-assisted assessment so the program scales with the company without losing depth on critical vendors. 

• Program Ownership & Risk Decisions: Own the TPRM lifecycle, including intake, risk tiering, due diligence, risk rating, reassessment, and secure offboarding. Design tiering so effort scales with risk: low-risk vendors move quickly, and critical vendors get deep scrutiny. Make and defend risk-based decisions on critical vendors (approve, approve with conditions, or escalate for formal risk acceptance), and maintain an accurate inventory of vendors, data flows, integrations, and fourth-party dependencies. 

• Beyond the Questionnaire: Replace self-attestation with evidence-based assurance for critical vendors: SOC 2 Type II exceptions, complementary user entity controls, and subservice organizations; penetration test results; architecture, data-flow, and integration reviews (including API and OAuth connections between platforms); vendor access reviews; and external attack surface data. Drive remediation plans to closure with named owners and dates. 

• Critical Vendor Partnerships: Serve as the primary security relationship owner for critical vendors, such as payment, point-of-sale, cloud, and mobile app and loyalty platforms. Build relationships with vendor security leadership, establish named contacts and escalation paths, lead recurring security business reviews, align on roadmaps and remediation commitments, and track performance against contractual security obligations, so critical vendors work with Dutch Bros as a partner, not a checkbox. 

• Third-Party Incident Response Planning: Design and maintain third-party incident response playbooks, contact trees, and notification requirements for critical vendors, integrated with the enterprise incident response and business continuity plans. Design and lead joint tabletop exercises with critical vendors, internal teams (Security Operations, IT, Legal, Privacy, Communications, Franchise Operations, and business owners), and senior leadership, and drive lessons learned to closure. 

• Third-Party Incident Leadership: When a vendor has a security incident, breach, or major outage, lead the third-party side of the response: confirm scope and Dutch Bros exposure, work directly with the vendor’s security leadership, drive containment on our side (e.g., credential rotation, access suspension, or disabling integrations), keep Security Operations, Legal, and executives informed, and provide the facts Legal and leadership need for notification and disclosure decisions. Lead the post-incident review and hold vendors to follow-up commitments. 

• Continuous Monitoring & Resilience: Run continuous monitoring of third-party risk posture (security ratings, breach and threat intelligence, expiring certifications, ownership changes) and act on what it surfaces. Identify concentration risk among critical vendors, partner with IT and business continuity owners on contingency and exit plans, and get ahead of emerging risks such as AI-enabled vendor services, SaaS sprawl, and fourth-party exposure. 

• Contracts & Secure Sourcing: Partner with Legal and Procurement to set standard security terms (breach notification, data protection, right-to-audit, security SLAs, cyber insurance, and exit provisions) and negotiate them with critical vendors. Bring security into sourcing early so requirements shape vendor selection, not just onboarding. 

• Metrics & Executive Reporting: Define and own TPRM KPIs and key risk indicators (KRIs), such as critical vendor coverage, high-risk findings and aging, remediation commitments met, vendor incident response times, and tabletop participation. Report third-party risk posture to senior leadership in business terms and contribute content for executive and board-level updates. 

• Regulatory & Audit Readiness: Ensure third-party controls meet PCI DSS, SOC 2, privacy, and public company disclosure expectations. Serve as the third-party expert in audits and track third-party risks through treatment. 

• Mentorship & Influence: Mentor analysts and raise TPRM literacy across Cybersecurity, Procurement, and the business, building a network of vendor owners who know their security responsibilities and when to engage. 

Skills:

• TPRM Strategy & Program Design 

• Critical Vendor Partnership 

• Evidence-Based Control Validation 

• Cloud, SaaS & Integration Risk 

• Third-Party Incident Response Leadership 

• Tabletop Exercise Design & Facilitation 

• Contract & SLA Security Negotiation 

• Risk Quantification & Prioritization 

• Executive Communication & Influence 

• Regulatory & Framework Expertise 

• Data Storytelling & Reporting 

• Mentorship & Coaching 

• Strategic & Critical Thinking 

• Composure Under Pressure 

Job Qualifications: 

• Bachelor’s degree in cybersecurity, information systems, computer science, risk management, or a related field, or an equivalent combination of education and experience. 

• 5–8 years of experience in cybersecurity, GRC, risk management, or IT audit, including at least 3 years dedicated to third-party/vendor risk management. 

• Demonstrated success building or significantly maturing a TPRM program, including moving from questionnaire-driven assessments to risk-tiered, evidence-based assurance and continuous monitoring. 

• Deep expertise evaluating vendor security, including SOC 2 Type II reports (exceptions, complementary user entity controls, and subservice organizations), penetration test results, cloud and SaaS architecture, data flows, identity and access models, and API and integration security. 

• Has led or played a central role in responding to a significant third-party security incident and has designed incident response playbooks and facilitated tabletop exercises with senior leaders and external partners. Familiarity with NIST SP 800-61 incident handling practices. 

• Proven ability to build trusted relationships with vendor security leaders and executives and to hold them accountable to remediation plans and contractual commitments. 

• Experience partnering with Legal and Procurement to define and negotiate security terms, such as data protection addenda, breach notification timelines, right-to-audit clauses, security SLAs, cyber insurance requirements, and exit provisions. 

• Expert knowledge of third-party risk frameworks and regulations, including NIST CSF 2.0 (Cybersecurity Supply Chain Risk Management), NIST SP 800-161, ISO/IEC 27001 and 27036, SOC 2, PCI DSS v4.x (including third-party service provider management), applicable privacy laws (e.g., CCPA/CPRA), and SEC cybersecurity disclosure requirements as they relate to third parties. 

• Exceptional executive communication skills, with the ability to translate third-party risk into business impact, make clear recommendations, and stay calm and decisive during incidents. Experience with risk quantification (e.g., FAIR) is a plus. 

• A record of thought leadership, such as setting program strategy, presenting to executive leadership, or contributing to industry and peer groups (e.g., RH-ISAC, Shared Assessments). Conference speaking or published work is a plus. 

• Hands-on experience with GRC and vendor risk platforms (e.g., UpGuard, ServiceNow IRM, OneTrust, Archer, SecurityScorecard, BitSight), ideally including selecting, implementing, or optimizing one. Experience using automation or AI to scale assessments is a plus. 

• At least one relevant certification required (e.g., CTPRP, CISA, CRISC, CISSP, CISM). 

Location Requirement: 

This role is based in Tempe, Arizona, and works in the office four days per week (Monday - Thursday), with Fridays as optional remote workdays. 

Physical Requirements:

• In-Office Environment: Must be able to work in a busy, crowded, and loud office with frequent distractions and interruptions 

• Must be able to collaborate in-person with occasional impromptu in-person meetings  

• Office Conditions: Adaptability to typical office conditions, which may include exposure to air conditioning, heating, artificial lighting, and varying noise levels 

• Mobility: Ability to sit, stand, reach, twist, stretch, and work at a desk for long stretches.  Must be able to occasionally move or lift office items up to 25 pounds 

• Hearing Requirements: Hearing must be sufficient or correctable to ensure clear understanding of spoken information, including participating in virtual meetings and phone calls. Use of hearing aids or other assistive devices is acceptable if needed. 

• Reading and Writing Proficiency: Ability to read and write in English is essential for processing documents, drafting reports, and following up on necessary actions. Proficiency in written communication is required to handle job-related tasks effectively. 

• Vision Requirements: Vision must be adequate or correctable to perform essential job duties, such as reading documents on a computer screen and using other visual tools. Use of corrective lenses or other measures to meet visual requirements is expected if needed. 

• Technology Proficiency: Must be proficient in operating a computer and other office productivity tools such as printers, scanners, and collaboration software.  

• Effective Communication: Must possess strong verbal and written communication skills to interact effectively with team members, clients, and other stakeholders via email, video conferencing, and other in office communication tools. 

Compensation:

DOE

If you like wild growth and working in a unique and fun environment, surrounded by positive community, you'll enjoy your career with us!