What’s your story?
What’s your story?
Curriculum Vitae
Career Accomplishments
Talent Stacks
My career in technology and cybersecurity began in the mid-1990s at the University of Texas at Arlington, where I worked at UTA Engineering Television as Technical Director and Webmaster. Those years were hands-on media production, broadcast systems, and the first digital pipes that would later become the backbone of the environments I now govern. I finished a Bachelor of Arts in History there. The history degree was not a detour. It taught me that institutions fail in patterns, and that a story with evidence beats a slogan.
After UTA I moved to Dallas and joined Internet America in Policy Enforcement — early information security before most companies had the phrase. I spent seven years there, 1998 to 2005, on policy, monitoring, and the unglamorous work of protecting a large ISP in the dial-up and early-broadband years. I also built and ran Airscreen, a web and mail filtering product for those customers. That was software you shipped, not a slide about software. The mess of real networks is what sent me to an MBA in Information Assurance at the University of Dallas — at the time one of about fifty NSA Centers of Academic Excellence, and the only business school in that set. I wanted information security treated as business risk, not as a help-desk specialty. The mix of rigorous faculty, adjuncts who still had dirt under their nails, and peers who had already sat in the chair made the program a high-water mark.
The builder years were CVS Caremark (2007–2011). I engineered the enterprise GRC platform and the IAS/SOX/SOD compliance engine from the ground up at Fortune 7 healthcare scale, led a team building the IAM platform, tested SOX IT general controls against SAP financial systems, and sat as the external-auditor point of contact through three consecutive SOC cycles with zero major findings. The scope was retail pharmacy and PBM compliance under HIPAA, PCI-DSS, and SOX — not clinical trials. If you want to know whether I can stand up a control system rather than administer someone else’s, that is the chapter.
Consulting followed. At Sirius Computer Solutions (2011–2017) I moved from Enterprise Security Architect to Security Solutions SME to Managing Security Consultant, and I worked as an ethical hacker. I founded a metadata-leakage practice, built the tool behind it, supported FedRAMP work, and served as incident commander for the firm’s Heartbleed response across more than a dozen enterprise clients. At Unisys (2017–2018) I advised a global insurer as CISO Advisor and Consulting Senior Manager — GDPR privacy policy, SOX control frameworks, and the kind of proposal work that has to survive a buyer’s counsel. At CoreLogic (2022–2023) I was Principal, Corporate Information Security, doing infrastructure risk assessment for fintech operations in cloud production.
In 2024 I was Vice President, Risk Assurance at JPMorganChase in Plano. That seat was second-line challenge of first-line technology risk under OCC Heightened Standards — a G-SIB environment that does not accept narrative in place of evidence. I led the Cybersecurity Technology Controls Findings Management program, ran a team of analysts, and briefed executives on remediation in language they could use. I keep first-line ownership and second-line challenge in separate drawers. Mixing them is how control functions lose the room.
From January 2025 through August 2026 I was Lead, Cybersecurity Governance, Risk & Compliance at Lennar Corporation in Irving, across Homebuilding, Mortgage, and Title. I ran policy, risk assessment, control testing, and remediation priority against NIST CSF, ISO/IEC 27001, SEC, GLBA, and privacy law. The artifact I am willing to put on the table is AIMS v2.0, the enterprise Artificial Intelligence Management System I wrote from scratch and that cleared internal audit in 2025. It covers the full AI lifecycle, agentic AI controls, a model and agent registry, risk-tiering with go/no-go criteria, incident response, acceptable use, TEVV, secure development and deployment, and third-party AI vendor oversight, aligned to NIST AI RMF, ISO/IEC 42001, the EU AI Act, and ISACA AAISM. I put automated risk-assessment agents into the vendor-onboarding workflow, wrote the AI policy suite and the Confluence architecture around it, led 2026 cyber-insurance renewal responses on biometrics and tracking technologies, coordinated PwC’s modernization of the Information Management & Cybersecurity Policy, partnered with the CISO and Engineering on SOC 2, NIST, and Kroll penetration-test remediation, and wrote Board-facing risk material including the Board Risk Overview of December 2025.
I now give full attention to the two organizations I already had running. I founded Stage Four Security in 2019 — a North Texas Fractional CISO and advisory practice aimed at a proactive security culture: policy, training, risk management, and AI governance, standardized to NIST and ISO/IEC 27001. It is also the lab. The Moments of Security is where I distill predictive signals, anomaly detection, and behavioral trends into something an operator can use. In January 2025 I launched the Stage Four Institute, a not-for-profit for education and outreach — workshops that have trained 100+ professionals, open research, and The Connections of Cybersecurity, a network meant to put usable knowledge in front of students, nonprofits, small businesses, and practitioners who do not have a Fortune-7 GRC bench.
From 2014 to 2018 I was Adjunct Professor of Technology Management at the University of Dallas. I taught graduate quantitative risk, KRI/KPI design, threshold calibration, executive reporting, and GRC to 200+ students. The classroom and the Board paper are the same craft: measure it, set a threshold, say what the number means.
Over thirty years I have watched productivity tools arrive with new failure modes attached. I have integrated M&A security, colocation, cloud, and Zero Trust. The anchor does not change. Address the risk early enough that value can compound, and do not confuse a policy that photographs well with a control that operates.
My public voice at @James_K_Bishop is the lighter edge of the same person. Sharp, principled, often conservative with a Federalist lean. Government overreach, regulatory burden, AI freedom versus control, cybersecurity policy, the ethics of innovation — turned into stories instead of fog. The longer form lives at jameskay.online, where I write as a raconteur: Texas heritage, civic order, sovereignty, the meeting point of technology and liberty. Clear language is not decoration on the cybersecurity work. It is how a control gets funded, staffed, and run.
I thrive on addressing risk to build lasting value — one framework that actually operates, at a time.