Senior Cybersecurity Analyst, Third‑Party Risk

Dutch Bros Coffee•Phoenix, AZ

19h•Hybrid

About The Position

The Senior Cybersecurity Analyst, Third-Party Risk is a senior individual contributor and the subject matter expert for third-party risk within Dutch Bros Coffee’s Governance, Risk, and Compliance team. The role owns and sets the direction for the Third-Party Risk Management (TPRM) program, building security partnerships with critical vendors, validating controls using evidence, and preparing Dutch Bros and its vendors to respond jointly to incidents. The role advises senior leadership on vendor risk decisions and strengthens how the business selects, onboards, and manages vendors. The position owns the TPRM lifecycle, including intake, risk tiering, due diligence, risk ratings, reassessment, monitoring, and secure offboarding. It develops program strategy and policies, performs evidence-based assurance of critical vendors, maintains vendor and dependency information, and drives remediation plans to completion. It also leads critical-vendor security relationships, third-party incident planning and response, joint tabletop exercises, contract security efforts with Legal and Procurement, executive risk reporting, and audit readiness. The role mentors analysts and promotes third-party risk awareness across the company. The role is based in Tempe, Arizona. It works in the office four days per week, Monday through Thursday, with Fridays as optional remote workdays. Compensation is DOE.

Requirements

Bachelor’s degree in cybersecurity, information systems, computer science, risk management, or a related field, or an equivalent combination of education and experience.
5–8 years of experience in cybersecurity, GRC, risk management, or IT audit, including at least 3 years dedicated to third-party/vendor risk management.
Demonstrated success building or significantly maturing a TPRM program, including moving from questionnaire-driven assessments to risk-tiered, evidence-based assurance and continuous monitoring.
Deep expertise evaluating vendor security, including SOC 2 Type II reports, exceptions, complementary user entity controls, subservice organizations, penetration test results, cloud and SaaS architecture, data flows, identity and access models, and API and integration security.
Experience leading or playing a central role in responding to a significant third-party security incident, designing incident response playbooks, and facilitating tabletop exercises with senior leaders and external partners.
Familiarity with NIST SP 800-61 incident handling practices.
Ability to build trusted relationships with vendor security leaders and executives and hold vendors accountable to remediation plans and contractual commitments.
Experience partnering with Legal and Procurement to define and negotiate security terms, such as data protection addenda, breach notification timelines, right-to-audit clauses, security SLAs, cyber insurance requirements, and exit provisions.
Expert knowledge of third-party risk frameworks and regulations, including NIST CSF 2.0, NIST SP 800-161, ISO/IEC 27001 and 27036, SOC 2, PCI DSS v4.x, applicable privacy laws such as CCPA/CPRA, and SEC cybersecurity disclosure requirements as they relate to third parties.
Exceptional executive communication skills, including the ability to translate third-party risk into business impact, make clear recommendations, and remain calm and decisive during incidents.
At least one relevant certification, such as CTPRP, CISA, CRISC, CISSP, or CISM.
Ability to work in a busy, crowded, and loud office with frequent distractions and interruptions and collaborate in person, including occasional impromptu meetings.
Ability to adapt to typical office conditions, including air conditioning, heating, artificial lighting, and varying noise levels.
Ability to sit, stand, reach, twist, stretch, and work at a desk for extended periods, and occasionally move or lift office items up to 25 pounds.
Hearing sufficient or correctable to understand spoken information and participate in meetings and calls; assistive devices are acceptable if needed.
Ability to read and write in English for document processing, report drafting, and job-related follow-up.
Vision adequate or correctable to perform essential duties, including reading computer-screen documents and using visual tools.
Proficiency with computers and office productivity tools, including printers, scanners, and collaboration software.
Strong verbal and written communication skills for interacting with team members, clients, and other stakeholders.

Nice To Haves

Experience with risk quantification methods such as FAIR.
Thought leadership, such as setting program strategy, presenting to executive leadership, or contributing to industry and peer groups such as RH-ISAC or Shared Assessments.
Conference speaking or published work.
Hands-on experience with GRC and vendor risk platforms such as UpGuard, ServiceNow IRM, OneTrust, Archer, SecurityScorecard, or BitSight, ideally including selecting, implementing, or optimizing a platform.
Experience using automation or AI to scale assessments.

Responsibilities

Set the multi-year vision and roadmap for the TPRM program, aligned with business priorities and risk appetite.
Author and maintain third-party security policies, standards, and the operating model; provide thought leadership and bring in tooling, automation, and AI-assisted assessment to scale the program.
Own the TPRM lifecycle, including vendor intake, risk tiering, due diligence, risk rating, reassessment, continuous monitoring, and secure offboarding.
Make and defend risk-based decisions for critical vendors, including approval, conditional approval, or escalation for formal risk acceptance.
Maintain an accurate inventory of vendors, data flows, integrations, and fourth-party dependencies.
Validate critical vendors’ controls using evidence, including SOC 2 reports, penetration test results, architecture and data-flow reviews, API and OAuth integration reviews, vendor access reviews, and external attack surface data.
Drive vendor remediation plans to closure with assigned owners and dates.
Serve as the primary security relationship owner for critical vendors; establish contacts and escalation paths, lead recurring security reviews, align on roadmaps and remediation commitments, and track contractual security performance.
Design and maintain third-party incident response playbooks, contact trees, and notification requirements, integrating them with enterprise incident response and business continuity plans.
Design and lead joint tabletop exercises with critical vendors, internal teams, and senior leadership; drive lessons learned to completion.
Lead the third-party component of vendor incident, breach, or major outage response, including confirming scope and exposure, coordinating with vendor security leaders, driving containment actions, informing internal stakeholders, and supporting notification and disclosure decisions.
Lead post-incident reviews and hold vendors accountable for follow-up commitments.
Monitor third-party risk posture, including security ratings, breach and threat intelligence, expiring certifications, and ownership changes, and act on identified risks.
Identify critical-vendor concentration risk and partner with IT and business continuity owners on contingency and exit plans; address emerging risks such as AI-enabled vendor services, SaaS sprawl, and fourth-party exposure.
Partner with Legal and Procurement on standard security terms and negotiations, and engage security early in sourcing and vendor selection.
Define and own TPRM KPIs and KRIs, report risk posture to senior leadership in business terms, and contribute to executive and board-level updates.
Ensure third-party controls meet PCI DSS, SOC 2, privacy, and public company disclosure expectations; serve as the third-party expert in audits and track risks through treatment.
Mentor analysts and raise third-party risk literacy across Cybersecurity, Procurement, and the business.