System Security Officer (SSO) (5676)

About the role

SMX is seeking a highly motivated and experienced System Security Officer (SSO) to lead the security and compliance efforts for our innovative CFO Control Tower Budget and Spend (BAS) solution. The CFO Control Tower is a pre-built planning and reporting tool designed specifically for the federal government, operating on the SAP Analytics Cloud (SAC) platform. This is a full-time position that is 100% remote and will require minimal travel

Responsibilities

• Security Authorization: Coordinate with the customer’s security team, ensuring they receive all the necessary FedRAMP documentation, and manage which security controls fall on the SMX implementation team vs. the customer, also providing the necessary support needed for the Risk Management Framework (RMF) process to achieve and maintain its Authority to Operate (ATO).
• System Security Plan (SSP): Support the development, documentation, and maintenance of the SSP and related security documents, including the System Architecture, Contingency Plan, and Incident Response Plan.
• Vulnerability Management: Support a comprehensive vulnerability management program, including regular scanning, risk assessment, and oversight of the Plan of Actions & Milestones (PO&AM).
• Continuous Monitoring: Oversee the design and monitoring strategy to ensure the system complies with federal mandates and organizational policies.
• Cloud Security: Serve as the subject matter expert for the SAP Analytics Cloud (SAC) environment, understanding and managing the inheritance of FedRAMP controls and liaising with the platform provider on security matters.
• Auditing & Logging: Ensure security and audit logs are being collected, reviewed, and retained in accordance with federal requirements; investigate and report on security incidents.
• Stakeholder Collaboration: Act as the primary security point of contact, collaborating with federal clients, system owners, developers, and the Authorizing Official (AO) to communicate risk and manage security requirements.
• Policy & Compliance: Ensure