Head of ICT, EU

Tide is hiring an ICT Manager for Tide Platform S.A. (TPSA), our EU entity. The role is based in Luxembourg and employed by TPSA, reporting locally to Authorised Management and functionally to Tide's Chief Data and Technology Officer. It is the senior technology role in the entity, sits in the first line of defence, and exists because ICT decisions for TPSA are taken in Luxembourg, by the entity.

Tide's group engineering function builds and runs the platform. Your job is to set what TPSA requires of it, verify that it is delivered, approve the changes that affect the entity, and require remediation when our standards are not met. That covers the entity's ICT risk management framework, digital operational resilience strategy, DORA obligations, cloud estate and first line security requirements.

Much of the role is outsourcing. TPSA's technology and business support reach it through an intra-group arrangement with Tide Platform Ltd, our FCA-regulated UK subsidiary, and a third-party estate of thirty arrangements supporting critical or important functions, spanning Luxembourg and our branches and subsidiaries in Germany, France, Bulgaria and Romania. Independent second line oversight sits with our Business Information Security Officer and Operational Risk Manager, and assurance with Internal Audit.

- Own the entity's ICT Strategy, the ICT project roadmap and digital operational resilience strategy

- Act as Service Owner for the intra-group arrangement with Tide Platform Ltd, setting service levels and evidence rights, monitoring performance and assessing material change

- Direct the outsourcing lifecycle for the entity, from due diligence and contractual protections to registers, monitoring, exit strategy and CSSF notification. We intend for you to take on the Outsourcing Officer mandate, subject to appointment by Authorised Management

- Own the entity's position on criticality and concentration risk across the third-party estate, including cloud, and the exit strategies behind it

- Be accountable for TPSA meeting its DORA obligations in practice: asset and critical function classification, incident management, resilience testing and exit planning

- Set the entity's first line ICT security requirements, verify they are met, and govern how TPSA uses AI

- Report ICT and third-party risk to Authorised Management and the Board Risk and Compliance Committee, and lead our ICT dialogue with the CSSF, including audits and regulatory examinations