AVP Operational & Technology Risk Management

Tidal's Assistant Vice President ("AVP") of Operational & Technology Risk Management is a multidisciplinary role that will be a valued contributor to delivering and managing our AI-driven Program target state. The AVP will leverage their operational and technology risk expertise and technical capabilities to use automation and AI to support our target state mission, which will deliver a fully integrated Program that maximizes the efficiency and value of its processes and reporting. The AVP’s core responsibilities include operational risk management, Risk and Control Self-Assessment (RCSA), technology and cybersecurity risk, third-party risk, and change management risk.

Reporting directly to the VP of Risk Management, the AVP will bring a passionate, entrepreneurial, and disciplined mindset towards ensuring we maximize our Program’s contribution and value to Tidal as it continues to grow and become more operationally complex

· Operational Risk Management: Build and manage an Operational Risk Management program that includes the identification and assessment of operational, technology, cybersecurity, third-party, fraud, people, legal, and model risks, as well as related controls and risk appetite limits, at the enterprise level and across all funds.

· Risk and Control Self-Assessment Program: Build and manage an RCSA program that systematically identifies, evaluates, and scores operational risks and the effectiveness of the controls mitigating them. Periodically test controls using a risk-based approach and a defined testing calendar and remediate all identified control gaps through documented corrective action plans. Utilize automation and AI to increase efficiency and consistency, including generating process flows, designing and automating controls, testing and assessing control effectiveness. Ensure detailed procedures with key controls are documented and executed across Tidal.

· Technology and Cybersecurity Risk Management: Build and manage a Technology and Cybersecurity Risk Management program to provide independent risk oversight and constructive challenge of technology governance, cybersecurity, cloud and infrastructure, identity and access management, data, software development and change, artificial intelligence, and system resilience. Collaborate with the Technology & Operations department to increase the use of automation and AI to enhance real-time risk sensing and anomaly detection to identify emerging technology and cybersecurity threats.

· Third-Party Risk Management (TPRM): Build and manage a comprehensive TPRM that identifies, assesses, and mitigates risks posed by external third parties, including vendors, service providers, counterparties, and brokers. Oversee risk across the third-party lifecycle, including due diligence, risk tiering, contracting, ongoing monitoring, issue and control management, and exit planning. Assess operational, technology, cybersecurity, financial, regulatory, reputational, and concentration risks for third parties and confirm that contingency plans address material dependencies.

· Change Management Risk: Build and manage a Change Management Risk program to identify and assess risks associated with material organizational or process changes, new products, systems, and vendors. Confirm that risk mitigation measures and controls have been implemented and tested, issues have been resolved, and operational readiness activities have been completed before implementation. Update affected RCSAs when the risk or control environment changes.

· Issue & Incident Management and Business Continuity Plan (BCP): Support our Issue & Incident Management and BCP programs in a variety of ways including by identifying control breakdowns and supporting the design of enhanced controls and related processes to prevent the recurrence of issues and incidents.

· Risk Intelligence: Support the design and implementation of our Risk Intelligence data and reporting using automation, AI, and visualization tools to efficiently deliver data-driven risk insights, forward-looking predictive analytics, and forecasts that drive proactive, risk-informed decisions.

· Cross-Functional Leadership: Serve as a trusted partner within Tidal’s growth-oriented, entrepreneurial culture by providing balanced challenge, thoughtful insights, and practical recommendations.

· Bachelor’s degree in Cybersecurity, Information Systems, Electrical/Computer Engineering, Computer Science, Risk Management or a related technical discipline.

· 5+ years of relevant experience in operational risk, technology and cybersecurity risk, third-party risk, IT audit, or internal controls within asset or investment management, ETF platforms, or broader financial services.

· Relevant professional certifications such as CISA, CRISC, CISSP, or CIA.

· Working knowledge of operational and technology risk frameworks and standards, such as COSO, COBIT, NIST, or ISO.

· Experience designing, implementing, or leading an RCSA program, including methodology development, risk and control taxonomies, inherent and residual risk scoring, assessment scoping, evidence review, control evaluation, and governance reporting.

· Experience using automation, AI, data analytics, and data visualization to improve risk identification, assessment, monitoring, RCSA execution, workflow management, dashboards, and reporting.

· Exceptional written, verbal, facilitation, and interpersonal skills, with the ability to translate complex operational and technology risks into clear decisions, provide credible challenge, and influence stakeholders in a fast-paced, high-growth environment.