• Develop and carry out a risk-based internal audit plan for IT operations, security controls, and compliance processes • Conduct audits from planning through reporting, evaluating the effectiveness of IT controls, policies, and procedures • Identify control gaps and IT-related risks during audits • Prepare clear audit findings reports and work with stakeholders on remediation plans • Work closely with IT, Security, Engineering, and other teams to gather evidence and facilitate audit processes • Serve as a liaison with external auditors and internal teams • Support external compliance audits and certifications • Maintain comprehensive audit workpapers and documentation repositories using a modern GRC tool • Help build audit playbooks and improve audit workflows • Stay up-to-date on industry best practices and emerging regulations

• Responsible for delivery, in terms of timeliness and quality, of site activation readiness within the assigned country/sites and foreseeing and mitigating any risks. • Preparation of Clinical Trial Application Forms as well as preparation of submission dossier (initial and amendments/notifications) for submission to CA, EC, and other applicable local bodies according to local requirements and within required timelines to obtain all necessary authorizations/approvals for the conduct of the Clinical Trial according to international and local/national applicable regulations, company SOPs and principles of ICH-GCP. • Interaction with CA/EC for study purposes and handling responses to the CA/EC. • Providing regular updates about CA and EC submissions to the Start Up Lead and/or Regulatory Lead assigned to the study and to Project Manager/Project Team as relevant. • Maintenance of project plans, project trackers and regulatory intelligence tools as it pertains to assigned responsibilities and to keep Regulatory Leadership updated. • Preparation/Support the development of study specific start-up plans, IMP release requirements and essential document review criteria. • Partner with the assigned site CRA to ensure alignment in communication and secure site collaboration. • Prepare. review and manage collection of essential documents required for site activation/IMP release. • Customize country/site specific Patient Information Sheet and Informed Consent Forms. • Responsible for/facilitates the translation and co-ordination of translations for documents required for submission. • Maintain communication with other key functions participating to country start up i.e., Feasibility, Clinical Operations, Project Management, Regulatory, and Site Contracts management group on project specific status and deliverables. • Act as SME for collection and maintenance of site level critical path to Site Activation data points, including but not limited to Competent Authority, local IRB/Ethics Committee (EC) timelines, site contracts and budget negotiation requirements for and other required reviews to secure on time site activation for the assigned sites in the country. • When required, participate/support the negotiation of study budgets and the execution of investigator contracts under directions of Site Contract Management department/designee department.

• Coordinate the end-to-end preparation, review, and timely filing of postmarket reporting submissions. • Coordinate with cross-functional teams (i.e., Marketing, Brand, Commercial, Regulatory Science, Legal, etc.) to organize all applicable aspects of postmarket reporting submission materials and ensure compliance with U.S. federal regulatory obligations. • Manage complex regulatory timelines, ensuring all stakeholders meet milestones for recurring federal filings. • Assess and identify potential regulatory risks related to advertising, promotion, labeling, and operations and work with Regulatory Leadership to mitigate potential risks. • Maintain up-to-date knowledge of evolving regulatory requirements and sales and distribution restrictions applicable to tobacco product marketing and advertising in the U.S. • Perform related duties as assigned, within your scope of practice.

• Support regulatory and partner oversight — Help prepare, organize, and respond to requests for information from regulators, auditors, and partner banks related to Tilt’s lending operations and compliance practices. • Automate compliance processes — Partner with internal teams and leverage AI tooling to streamline and automate evidence gathering, monitoring and reporting, and/or compliance testing. • Support continuous monitoring — Use SQL, dashboards, and automation tools to establish real-time monitoring and alerting systems that detect anomalies or potential compliance issues. • Leverage AI thoughtfully — Identify opportunities to use AI to surface insights, detect risk patterns, and reduce manual workload in compliance operations. • Collaborate across teams — Partner with Product, Engineering, and Risk to embed compliance by design into Tilt’s products and workflows.