Answer:
I am not aware of a requirement that the SO be an employee of the bank, but rather they do need to be designated to that position. It is most important that the bank demonstrate that the person has the ability and authority to carry out the duties assigned to them.
In my bank, we actually had two banks under one holding company. We had one SO who was designated by each board to the position and he was able to service both banks with subordinates at each assigned other security related duties. So what you ask is done and we were never questioned about it, much less criticized.