Manager, Third-Party Risk Management (TPRM)

DoorDash USA

2d•$164,200 - $241,500

About The Position

DoorDash is seeking a Third-Party Risk Management (TPRM) Manager to lead its global third-party risk program across DoorDash, Wolt, and Deliveroo. The role owns the vendor security risk lifecycle, leads technically complex assessments of suppliers connected to critical systems and data, and develops a team that makes clear, evidence-based risk decisions. It will also set the direction for an AI-native TPRM function and build agentic workflows that improve evidence gathering, risk assessment, and remediation follow-through. Reporting to the Global Head of GRC, the manager will serve as the US-based deputy, provide GRC leadership and escalation coverage during US business hours, and directly manage TPRM analysts and other US-based GRC team members assigned to the organization. The position is based in the United States, preferably in the Eastern or Central time zones, with core hours aligned to US business needs and handoffs with global colleagues. The role combines hands-on technical judgment, program ownership, and people leadership. It includes oversight of the vendor inventory, policies, assessment standards, and service levels; assessments and risk decisions for critical suppliers; development of AI and automation capabilities; team management; US-hours escalation support; and reporting on program performance and material risk. DoorDash offers equity grant opportunities and a comprehensive benefits package for regular employees. Benefits include a 401(k) with employer matching, paid parental leave, wellness and commuter benefits, paid time off and sick leave, medical, dental and vision coverage, paid holidays, disability and basic life insurance, family-forming assistance, and a mental health program. The posted national base salary range is $164,200–$241,500 USD; pay is localized and determined by job-related factors.

Requirements

At least 6 years of progressive experience in technical third-party risk, security risk, or security engineering, including substantial hands-on experience leading complex vendor assessments and owning a TPRM program.
A track record of improving risk practices in a technology environment.
Experience leading distributed teams and coordinating delivery across different GRC specialties.
Deep experience assessing enterprise integrations and failure modes, including SAML/OIDC federation, OAuth scopes and tokens, SCIM provisioning, APIs, service accounts, cloud IAM, network boundaries, and data flows; ability to translate findings into practical requirements and verified remediation.
Strong assurance and control-testing skills, including evaluating SOC 2 Type II scope, exceptions, subservice organizations, and customer responsibilities; interpreting penetration tests and relevant ISO 27001 or PCI DSS evidence; and validating evidence against the proposed service, integration, and data use.
An AI-native working approach, including active use of AI to improve work and experience building or piloting AI-assisted workflows; ability to articulate an agentic TPRM vision and explain output evaluation, failure handling, and protection of sensitive information.
Experience implementing or improving TPRM/GRC platforms and workflow automation, with practical knowledge of APIs and integration patterns; ability to define requirements, work with structured data, and partner with engineers.
Hands-on knowledge of cloud and SaaS security, privileged supplier or BPO access, data protection, incident response, and recovery; ability to apply security frameworks and threat modeling to vendor deployments and assess AI-specific risks.
Sound judgment and executive communication, including experience representing a security or GRC leader, making decisions within delegated authority, and resolving difficult risk tradeoffs.
Ability to build credibility with engineers, Legal, Procurement, and business leaders while managing urgent US-hours escalations.
Ability to work core hours aligned to US business needs and maintain clear handoffs with global colleagues.

Nice To Haves

Python, SQL, low-code orchestration, and production-scale agentic experience are advantages.

Responsibilities

Run day-to-day TPRM operations across the vendor lifecycle, from discovery and risk tiering through due diligence, onboarding, continuous monitoring, remediation, and exit.
Maintain a reliable vendor inventory, policies, assessment standards, and service levels across DoorDash, Wolt, and Deliveroo, covering cloud, SaaS, BPO, and other critical suppliers.
Lead assessments of vendors connected to critical systems, examining architecture, data flows, permissions, and control evidence; use threat modeling to identify compromise paths and define testable security requirements.
Turn assessment findings into accountable risk decisions; agree on mitigation plans and security contract terms with vendors and internal partners, verify remediation, document residual-risk acceptance, and confirm access removal and data handling at termination.
Address supplier dependencies, concentration risk, recovery capabilities, and exit readiness.
Set the vision and roadmap for an AI-native TPRM function, prioritize AI and automation opportunities, assess whether to configure, buy, or build solutions, and align delivery with Security Engineering, IT, and platform owners.
Build and pilot agentic workflows to gather and reconcile evidence, identify control gaps, draft assessments, and coordinate follow-up; scale effective use cases with traceability, evaluations, data protection, access controls, and human approval for consequential actions.
Own the TPRM framework for third-party AI and agentic services, assessing model and data providers, connectors, tool permissions, training-data use, retention, subprocessors, prompt injection, and data exfiltration; establish onboarding and monitoring requirements.
Hire, coach, and directly manage TPRM professionals and other US-based GRC direct reports; oversee goals, workload, performance reviews, career development, and succession planning.
Provide US-hours GRC coverage and escalation support in partnership with the Global Head of GRC; lead stakeholder discussions and coordinate GRC input to vendor incidents, audits, and urgent business decisions.
Exercise agreed delegated authority, route risk acceptance to accountable owners, and maintain clear decisions and handoffs with global leadership.
Report program and risk performance to leadership and auditors, including critical-system exposure, overdue remediation, exception aging, assessment quality, and review turnaround; measure AI and automation outcomes and translate material risks into business impact.