Model Validator

Smartsuite; Newport Beach (CA); On-site; USD 120,000 - 180,000; Full time

Job summary

Capitolis seeks a Model Validator to provide independent oversight of AI risk and performance assessments within SmartSuite. You will review issues, determine approval or cancellation, and ensure remediation is complete, with decisions fully traceable to evidence.

The role requires rigorous validation of model risk indicators, including drift, bias, safety, and compliance signals, and close collaboration with risk, audit, and governance teams to sustain governance standards.

Qualifications

• Must be able to independently validate model risk and performance assessments.
• Able to decide approval, conditional approval or cancellation of model use.
• Document validation decisions with traceable evidence.

Responsibilities

• Independently validate model risk and performance assessments.
• Decide approval, conditional approval or cancellation of model use.
• Monitor drift, bias, safety, security and compliance indicators.
• Review issues raised against models and set remediation conditions.
• Confirm remediation actions are completed and effective.
• Document validation decisions with traceable evidence.

Skills

Model risk validation

Independent oversight

Evidence-based decisions

Job description

SmartSuite for the Model Validator

The Model Validator provides independent oversight of AI risk and performance assessments, reviews issues and determines approval, conditional approval or cancellation. They monitor key AI risk indicators such as drift, bias, safety, security and compliance signals and confirm remediation is completed.

Reports to: Model Risk Manager

What you own

The Model Validator provides independent oversight of AI risk and performance assessments, reviews issues and determines approval, conditional approval or cancellation.

• Independently validate model risk and performance assessments
• Decide approval, conditional approval or cancellation of model use
• Monitor drift, bias, safety, security and compliance indicators
• Review issues raised against models and set remediation conditions
• Confirm remediation actions are completed and effective
• Document validation decisions with traceable evidence

At a glance

The GRC processes this role owns, touches and depends on.

Owns

accountable for the process

Touches

contributes or approves

Depends on

consumes its output

How the GRC processes connect

Three lines of defence set the frame; the chain shows where each process hands off to the next. Colours follow the Model Validator: navy is owned, blue is touched, grey is depended on.

1. First line: The business and its control owners. Run the processes, own the controls, fix the issues
2. Second line: Risk, compliance and the domain programmes. Set the frameworks, assess, monitor and advise
3. Third line: Internal audit. Independent assurance to the board and audit committee

Reporting lines

Who this role reports to, who reports to them, and the peers they work with most.

Reports to

Model Risk Manager

Works closely with

• Model Owner
• AI Risk Officer
• AI Governance Lead
• Internal Auditor

How SmartSuite supports the Model Validator

The Model Validator is the independent voice on whether a model may be used, and the Model Risk Manager, the AI Risk Officer and examiners expect each decision to rest on evidence and be traceable. SmartSuite gives validation a structured workflow with decision logs and linked issues, so independence is demonstrable, not asserted.

Validate independently with a traceable decision

Independence documented, not assumed

Clear ownership assigns the model owner, business owner and independent reviewer to each model with documented responsibilities, so your separation from development is on the inventory and visible to anyone who checks.

Exceptions tracked, not waved through

Exception requests run through the same review workflow as approvals, with the condition recorded, so a model operating outside approved scope is a tracked exception rather than an unwritten understanding.

Conceptual soundness checked in context

Connected model context shows the business processes, applications and datasets a model relies on, so you assess conceptual soundness and intended use against what the model actually touches rather than what the documentation says.

Work with model owners, risk and audit

• Issues raised with owners and deadlines attached: Each issue you raise links to the Model Owner, the mitigation, a deadline and the evidence of resolution, so a remediation condition is a tracked item on their list and a visible one on yours.
• Early signals before the incident: Early risk detection surfaces emerging risks from tracked indicators before they become regulatory or operational incidents, so the AI Risk Officer and you discuss a trend while it is still a trend.
• Validation files the Internal Auditor can test: Testing artifacts, review logs and supporting evidence are stored centrally against each model, so when the Internal Auditor samples a validation they read the file you built rather than a summary you write for them.

Stand behind every approval under examination

• Who approved what, when and why: Audit trails and version history keep full records of each validation decision, the reviewer and the rationale over time, so an examiner reconstructing an approval finds the reasoning you recorded at the time.
• Conformity assessments mapped to the regulation: Framework and regulatory alignment links models and assessments to laws, regulations and frameworks, so the conformity assessment the EU AI Act requires for a high-risk system is traceable to the requirement it satisfies.
• Scope kept to what was approved: Governance coverage tracking records the approved scope, controls and monitoring cycles for each model, so use outside the approved scope is a visible gap on the record rather than something discovered in outcomes analysis.

AI governance. Runs assessment workflows with reviewer decision logs and exception tracking so governance decisions are consistent and traceable.

Risk management. Monitors key AI risk and performance indicators such as drift, bias, safety and security signals.

Issues and actions. Ensures remediation actions are completed and validated before approval conditions are lifted.

Reporting. Records approval outcomes and open conditions for governance reporting.

Products this role uses most

AI Governance

Track AI models, assess risk, and document compliance across your enterprise in one platform.

CRI AI RMF

Manage AI risk with CRI and NIST AI RMF using assessments, governance workflows, and dashboards across your AI systems.

Issues Management

Track and remediate issues across audits, risk, and compliance with structured workflows, clear ownership, and real‑time visibility into resolution status.

Industry reference

The Federal Reserve's SR 26-2 and OCC Bulletin 2026-13 (17 April 2026, issued jointly with the FDIC) superseded SR 11-7 and OCC 2011-12 with risk-based guidance that keeps independent validation at its center: conceptual soundness, ongoing monitoring and outcomes analysis performed by people not involved in the model's development, with generative and agentic AI models outside its scope. The UK PRA's SS1/23 carries the same principle for banks, and ASOP 56 applies to actuarial models. NIST AI RMF's Measure function and ISO/IEC 42001 extend validation to AI and machine‑learning systems.

The EU AI Act requires conformity assessment of high‑risk systems; insurers validate pricing and underwriting models under NAIC and state expectations; healthcare validates clinical algorithms under FDA guidance; public bodies test rights‑impacting AI under OMB guidance before deployment.

Related roles

Model Risk Manager

Frequently asked questions

The Model Validator provides independent oversight of AI risk and performance assessments and decides whether a model is approved, conditionally approved or canceled. They monitor drift, bias, safety, security and compliance indicators, review the issues raised against models and set remediation conditions, confirm that remediation is completed and effective, and document every validation decision with traceable evidence. Independence is the point: the validator was not involved in the model's development, as SR 26-2 and the PRA's SS1/23 require.

AI Governance runs assessment workflows with reviewer decision logs and exception tracking, so governance decisions are consistent and traceable. The validator reviews the Model Owner's assessment in the workflow, records the decision and its reasoning in the decision log, and logs any exception granted with its conditions. CRI AI RMF supplies the assessment structure where that profile is used. A later reviewer, or the Internal Auditor, can see why a model was approved and on what conditions.

SmartSuite monitors key AI risk and performance indicators such as drift, bias, safety and security signals against each model, so the Model Validator sees when an indicator moves outside what the approval assumed and can raise an issue or revisit the conditions. The AI Risk Officer sees the same indicators for the risk view. Monitoring is part of the model's record, which is the ongoing monitoring that NIST AI RMF's Measure function and SR 26-2 expect.

Remediation actions are completed and validated in Issues Management before approval conditions are lifted, so a condition attached to a conditional approval stays open until the Model Owner has submitted evidence and the validator has confirmed it. The validator does not take a status update on trust; the evidence is on the issue, and the condition is lifted in the record. That sequence is what makes a conditional approval enforceable rather than advisory.

SmartSuite records approval outcomes and open conditions for governance reporting, so the Model Risk Manager sees each validation's decision, the conditions attached and which remain open without asking for a summary. The AI Governance Lead has the same view for governance meetings. Because the decision log and the conditions are the record, the report upward is a filter on it, and the evidence behind any decision is one step away.

A validator needs the models they are assigned to review, with their owners and the assessments due, and the criteria they apply when deciding approval. New customers can start with SmartSuite Onboarding, a guided four‑week program around one or two priority workflows; for a validation team the first workflow is the assessment review with its decision log. Decisions, conditions and exceptions from previous validations can be recorded so the history is complete, and from then on each model carries its decision log, which is what a regulator or auditor asks to see.