It's fun to work in a company where people truly believe in what they are doing. At Dutch Bros Coffee, we are more than just a coffee company. We are a fun-loving, mind-blowing company that makes a difference one cup at a time.
Position Overview:
Third-party cyber risk is the top cybersecurity risk at Dutch Bros, and this role exists to own it. The Senior Cybersecurity Analyst, Third-Party Risk is a senior individual contributor and the company’s subject matter expert and thought leader for third-party risk within the Governance, Risk, and Compliance (GRC) team. This person sets the direction for the Third-Party Risk Management (TPRM) program and takes it well beyond questionnaires: building real security partnerships with the critical vendors that power our shops, app, and payments; validating controls with tangible evidence; and making sure Dutch Bros and its vendors are ready to respond together when an incident hits. The role leads third-party incident response planning and coordination across vendors and internal teams, advises senior leadership on vendor risk decisions, and raises the bar for how the business selects, onboards, and manages its vendors.
Key Result Areas:
TPRM Strategy & Thought Leadership: Set the multi-year vision and roadmap for the TPRM program, aligned to business priorities and risk appetite. Author and maintain the third-party security policy, standards, and operating model. Serve as the company’s go-to expert on third-party cyber risk, bringing an outside-in view through peer benchmarking and industry groups, and shaping how leadership thinks about and invests in vendor risk. Bring in tooling, automation, and AI-assisted assessment so the program scales with the company without losing depth on critical vendors.
Program Ownership & Risk Decisions: Own the TPRM lifecycle, including intake, risk tiering, due diligence, risk rating, reassessment, and secure offboarding. Design tiering so effort scales with risk: low-risk vendors move quickly, and critical vendors get deep scrutiny. Make and defend risk-based decisions on critical vendors (approve, approve with conditions, or escalate for formal risk acceptance), and maintain an accurate inventory of vendors, data flows, integrations, and fourth-party dependencies.
Beyond the Questionnaire: Replace self-attestation with evidence-based assurance for critical vendors: SOC 2 Type II exceptions, complementary user entity controls, and subservice organizations; penetration test results; architecture, data-flow, and integration reviews (including API and OAuth connections between platforms); vendor access reviews; and external attack surface data. Drive remediation plans to closure with named owners and dates.
Critical Vendor Partnerships: Serve as the primary security relationship owner for critical vendors, such as payment, point-of-sale, cloud, and mobile app and loyalty platforms. Build relationships with vendor security leadership, establish named contacts and escalation paths, lead recurring security business reviews, align on roadmaps and remediation commitments, and track performance against contractual security obligations, so critical vendors work with Dutch Bros as a partner, not a checkbox.
Third-Party Incident Response Planning: Design and maintain third-party incident response playbooks, contact trees, and notification requirements for critical vendors, integrated with the enterprise incident response and business continuity plans. Design and lead joint tabletop exercises with critical vendors, internal teams (Security Operations, IT, Legal, Privacy, Communications, Franchise Operations, and business owners), and senior leadership, and drive lessons learned to closure.
Third-Party Incident Leadership: When a vendor has a security incident, breach, or major outage, lead the third-party side of the response: confirm scope and Dutch Bros exposure, work directly with the vendor’s security leadership, drive containment on our side (e.g., credential…