Senior Cybersecurity Analyst, Third-Party Risk

Dutch Bros Coffee is looking for a Senior Cybersecurity Analyst to own and lead its third-party cyber risk program from within the GRC team. Based in Tempe, AZ, this onsite role focuses on strengthening vendor assurance, planning for third-party incidents, and delivering executive-ready reporting for critical partners.

In this position, you will act as the subject matter expert for third-party risk management (TPRM) strategy and execution, with an evidence-based approach that balances speed for low-risk vendors with deeper scrutiny for critical vendors.

Responsibilities

• Set the multi-year vision and roadmap for the TPRM program, aligned to business priorities and risk appetite.
• Author and maintain the third-party security policy, standards, and operating model.
• Provide an outside-in perspective using peer benchmarking and industry groups to shape leadership thinking and investment decisions for vendor risk.
• Introduce tooling, automation, and AI-assisted assessment approaches to scale the program while retaining depth for critical vendors.
• Own the TPRM lifecycle, including intake, risk tiering, due diligence, risk rating, reassessment, and secure offboarding.
• Design tiering so effort scales with risk, enabling faster processing for low-risk vendors and deep scrutiny for critical vendors.
• Make and defend risk-based decisions for critical vendors, including approval, approval with conditions, or escalation for formal risk acceptance.
• Maintain an accurate inventory of vendors, data flows, integrations, and fourth-party dependencies.
• Move from self-attestation to evidence-based assurance for critical vendors, including SOC 2 Type II exceptions, complementary user entity controls, and subservice organizations.
• Review penetration test results for critical vendors.
• Conduct architecture, data-flow, and integration reviews, including API and OAuth connections between platforms.
• Run vendor access reviews and use external attack surface data.
• Drive remediation plans to closure with named owners and dates.
• Serve as the primary security relationship owner for critical vendors, such as payment, point-of-sale, cloud, mobile app, and loyalty platforms.
• Build relationships with vendor security leadership, set named contacts and escalation paths, lead recurring security business reviews, and align on roadmaps and remediation commitments.
• Track performance against contractual security obligations so critical vendors operate as partners, not check-the-box providers.
• Design and maintain third-party incident response playbooks, contact trees, and notification requirements for critical vendors.
• Integrate third-party incident response planning with enterprise incident response and business continuity plans.
• Design and lead joint tabletop exercises with critical vendors, internal teams (Security Operations, IT, Legal, Privacy, Communications, Franchise Operations, and business owners), and senior leadership.
• Drive lessons learned to closure.
• When a vendor has a security incident, breach, or major outage, lead the third-party side of response by confirming scope and Dutch Bros Coffee exposure.
• Work with the vendor’s security leadership to drive containment on the Dutch Bros side (for example, credential rotation, access suspension, or disabling integrations).
• Keep Security Operations, Legal, and executives informed with the facts needed for notification and disclosure decisions.
• Lead post-incident reviews and ensure vendors follow through on follow-up commitments.
• Run continuous monitoring of third-party risk posture (security ratings, breach and threat intelligence, expiring certifications, and ownership changes) and act on what the data surfaces.
• Identify concentration risk among critical vendors and partner with IT and business continuity owners on contingency and exit plans.
• Get ahead of emerging risks including AI-enabled vendor services, SaaS sprawl, and fourth-party exposure.
• Partner with Legal and Procurement to set standard security terms (breach notification, data protection, right-to-audit, security SLAs, cyber insurance, and exit provisions).
• Negotiate standard security terms with critical vendors.
• Bring security into sourcing early so requirements influence vendor selection, not only onboarding.
• Define and own TPRM KPIs and key risk indicators (KRIs), such as critical vendor coverage, high-risk findings and aging, remediation commitments met, vendor incident response times, and tabletop participation.
• Report third-party risk posture to senior leadership in business terms and contribute content for executive and board-level updates.
• Ensure third-party controls meet PCI DSS, SOC 2, privacy, and public company disclosure expectations.
• Serve as the third-party expert in audits and track third-party risks through treatment.
• Mentor analysts and raise TPRM literacy across Cybersecurity, Procurement, and the business.
• Build a network of vendor owners who understand security responsibilities and know when to engage.

Requirements

• Bachelor’s degree in cybersecurity, information systems, computer science, risk management, or a related field, or an equivalent combination of education and experience.
• 5–8 years of experience in cybersecurity, GRC, risk management, or IT audit, including at least 3 years dedicated to third-party/vendor risk management.
• Demonstrated success building or significantly maturing a TPRM program, including moving from questionnaire-driven assessments to risk-tiered, evidence-based assurance and continuous monitoring.
• Deep expertise evaluating vendor security, including SOC 2 Type II reports (exceptions, complementary user entity controls, and subservice organizations), penetration test results, cloud and SaaS architecture, data flows, identity and access models, and API and integration security.
• Has led or played a central role in responding to a significant third-party security incident and has designed incident response playbooks and facilitated tabletop exercises with senior leaders and external partners.
• Familiarity with NIST SP 800-61 incident handling practices.
• Proven ability to build trusted relationships with vendor security leaders and executives and to hold them accountable to remediation plans and contractual commitments.
• Experience partnering with Legal and Procurement to define and negotiate security terms, including data protection addenda, breach notification timelines, right-to-audit clauses, security SLAs, cyber insurance requirements, and exit provisions.
• Expert knowledge of third-party risk frameworks and regulations, including NIST CSF 2.0 (Cybersecurity Supply Chain Risk Management), NIST SP 800-161, ISO/IEC 27001 and 27036, SOC 2, PCI DSS v4.x (including third-party service provider management), applicable privacy laws (for example, CCPA/CPRA), and SEC cybersecurity disclosure requirements as they relate to third parties.
• Exceptional executive communication skills to translate third-party risk into business impact, make clear recommendations, and stay calm and decisive during incidents.
• Experience with risk quantification (for example, FAIR) is a plus.
• A record of thought leadership such as setting program strategy, presenting to executive leadership, or contributing to industry and peer groups (for example, RH-ISAC, Shared Assessments). Conference speaking or published work is a plus.
• Hands-on experience with GRC and vendor risk platforms (for example, UpGuard, ServiceNow IRM, OneTrust, Archer, SecurityScorecard, BitSight), ideally including selecting, implementing, or optimizing one.
• Experience using automation or AI to scale assessments is a plus.
• At least one relevant certification required (for example, CTPRP, CISA, CRISC, CISSP, CISM).
• Must be able to work in a busy office with frequent distractions and interruptions.
• Must be able to collaborate in-person with occasional impromptu in-person meetings.
• Ability to perform physical job duties, including sitting, standing, reaching, twisting, stretching, and working at a desk for long stretches, and occasionally moving or lifting office items up to 25 pounds.
• Hearing must be sufficient or correctable to ensure clear understanding of spoken information, including participating in virtual meetings and phone calls.
• Ability to read and write in English is essential.
• Vision must be adequate or correctable to perform essential job duties.
• Must be proficient in operating a computer and office productivity tools such as printers, scanners, and collaboration software.
• Strong verbal and written communication skills to interact effectively with team members, clients, and stakeholders via email, video conferencing, and in-office tools.

Location and Schedule

• Tempe, AZ (onsite)
• Works in the office four days per week (Monday through Thursday)
• Fridays are optional remote workdays

Technologies

• SOC 2 Type II
• PCI DSS v4.x
• NIST CSF 2.0 (Cybersecurity Supply Chain Risk Management)
• NIST SP 800-161
• ISO/IEC 27001
• ISO/IEC 27036
• NIST SP 800-61
• CCPA/CPRA
• SEC cybersecurity disclosure requirements
• SOC 2
• UpGuard
• ServiceNow IRM
• OneTrust
• Archer
• SecurityScorecard
• BitSight
• API
• OAuth
• FAIR

Compensation: DOE