James K. Bishop, IAM/IEM, CNSS 4011–4016

MBA, Information Assurance

What the work actually produced — not a second copy of the curriculum vitae.

Plano, Texas · Curriculum Vitae · Talent Stacks

James K. Bishop is an information assurance leader and educator with 30 years in information technology and information assurance and nearly two decades leading enterprise cybersecurity, GRC, AI governance, and technology risk. The through-line is the same in every seat: design the control system so it operates, evidence it so it survives audit, and explain the residual risk so executives can decide.

Professional Journey

James currently leads Stage Four Security, the North Texas Fractional CISO and advisory practice he founded in 2019, and Stage Four Institute, the education and outreach organization he founded in January 2025. Through the practice he designs security, GRC, and AI governance programs for regulated clients, standardized to NIST and ISO/IEC 27001, with 98% client satisfaction across seven years. Through the Institute he runs GRC workshops that have trained 100+ professionals, publishes at stagefour.org, and consults with K-12 institutions and academic partners to put usable security education in more hands.

Immediately before returning full attention to that practice, James served as Lead, Cybersecurity Governance, Risk & Compliance at Lennar Corporation in Irving, Texas (January 2025 – August 2026). He ran core pieces of the enterprise cybersecurity governance program across Homebuilding, Mortgage, and Title — policy, risk assessment, control testing, remediation priority, and alignment to NIST CSF, ISO/IEC 27001, SEC, GLBA, and privacy law. The centerpiece was AIMS v2.0, the firm’s Artificial Intelligence Management System, written from scratch and cleared by internal audit in 2025. It covered the full AI lifecycle, agentic AI controls, a model and agent registry, risk-tiering with go/no-go deployment criteria, incident response, acceptable use, TEVV, secure development and deployment, and third-party AI vendor oversight, aligned to NIST AI RMF, ISO/IEC 42001, the EU AI Act, and ISACA AAISM. He embedded automated risk-assessment agents in the vendor-onboarding workflow, authored the AI policy suite and Confluence information architecture, led 2026 cyber-insurance renewal responses on biometrics and tracking technologies, coordinated PwC-driven modernization of the Information Management & Cybersecurity Policy, partnered with the CISO and Engineering on SOC 2, NIST, and Kroll penetration-test remediation, and wrote Board-facing risk material including the Board Risk Overview of December 2025.

In 2024 James was Vice President, Risk Assurance at JPMorganChase in Plano, sitting in second-line challenge of first-line technology risk under OCC Heightened Standards. He led the Cybersecurity Technology Controls Findings Management program: analyzed control findings, managed gaps, drove remediation, and briefed executives in language a G-SIB leadership team will actually use. That year is the reason he can speak both first-line program ownership and second-line challenge without mixing the two up.

Earlier seats built the same muscle in different industries. At CoreLogic (2022–2023) he was Principal, Corporate Information Security — infrastructure risk assessment for fintech operations in cloud production, AWS IAM and network segregation, SIEM-centered detection, and vendor assurance. At Unisys (2017–2018) he was CISO Advisor and Consulting Senior Manager to a global insurer, writing GDPR privacy policy and SOX control frameworks and helping close multi-million-dollar security proposals. At Sirius Computer Solutions (2011–2017) he progressed from Enterprise Security Architect to Security Solutions SME to Managing Security Consultant, and worked as an ethical hacker. He founded a metadata-leakage consulting practice, built the analysis tool behind it, supported FedRAMP authorization work, and served as incident commander for the firm’s Heartbleed response across more than a dozen enterprise clients.

The builder chapter is CVS Caremark (2007–2011). As Senior Analyst, Information Security Regulatory Compliance — and before that in Security Shared Services and Security Monitoring and Policies — he engineered the enterprise GRC platform and IAS/SOX/SOD compliance engine from the ground up at Fortune 7 healthcare scale, led a team building the IAM platform, ran SOX ITGC testing against SAP financial systems, and served as the external-auditor point of contact through three consecutive SOC cycles with zero major findings. Scope was retail pharmacy and PBM compliance under HIPAA, PCI-DSS, and SOX — not clinical trials. He trained 200+ employees in security awareness while he was there.

The earlier spine is still part of the story: network security consulting at NEC Unified Solutions (2006), IT governance for healthcare at The Broadlane Group (2005), seven years at Internet America (1998–2005) enforcing policy and shipping Airscreen, a web and mail filtering product for ISP customers, and Technical Director and Webmaster for Engineering Television at the University of Texas at Arlington (1994–1998).

Educational Background and Certifications

James holds an MBA in Information Assurance from the University of Dallas and a Bachelor of Arts in History from the University of Texas at Arlington. Credentials are NSA IAM/IEM (INFOSEC Assessment and Evaluation Methodology) and the full CNSS 4011–4016 series: Information Systems Security Professionals, Senior Systems Managers, System Administrators, Information Systems Security Officers, Systems Certifiers, and Risk Analysts.

Engagement and Leadership

From 2014 to 2018 he was Adjunct Professor of Technology Management at the University of Dallas, teaching graduate quantitative risk measurement, KRI/KPI design, threshold calibration, executive risk reporting, technical data capture, GRC, and technology management to 200+ students, with 95% course satisfaction. That classroom is of a piece with the Institute workshops and with the way he writes Board papers: measure it, set a threshold, say what the number means.

On jameskay.online and at @James_K_Bishop he writes as a raconteur — conservative, federalist, Texas-rooted — on governance, policy, technology, and civic order. The same habit shows up in risk communication: a sharp vignette beats a stack of controls nobody will read.

Conclusion

The career is not a list of tools. It is a repeated pattern: stand up the control system, bind it to a standard a regulator or auditor already speaks, put evidence behind it, and carry the residual risk into a room that has to decide. Stage Four Security and Stage Four Institute are the current expression of that pattern. Lennar, JPMorganChase, CVS Caremark, Sirius, and the rest are the proof it travels across healthcare, banking, insurance, homebuilding, fintech, and independent practice.