Curriculum Vitae — James K. Bishop, IAM/IEM, CNSS 4011-4016

Curriculum Vitae

James K. Bishop, IAM/IEM, CNSS 4011–4016

MBA, Information Assurance

Cybersecurity · AI Governance · GRC · Technology Risk Leadership

Plano, Texas · jameskbishop@gmail.com · 972-316-9906

jameskbishop.com
linkedin.com/in/jameskbishop
jameskay.online
@James_K_Bishop

Professional Summary

Cybersecurity, AI governance, and enterprise risk leader with 30 years in information technology and information assurance and nearly two decades leading enterprise GRC, security architecture, identity and access management, adversarial analysis, and AI system governance. Career spans Fortune 7 healthcare (CVS Caremark), a U.S. G-SIB (JPMorganChase), insurance, real estate and homebuilding (Lennar), fintech (CoreLogic), multi-industry consulting (Sirius, Unisys), and an independent advisory practice.

Direct, hands-on experience engineering GRC and IAM platforms from the ground up rather than solely administering vendor products. Designed and deployed AIMS v2.0, a production enterprise AI Management System covering the full AI lifecycle, agentic AI controls, automated risk-assessment agents, and third-party AI vendor oversight, aligned to NIST AI RMF, ISO/IEC 42001, the EU AI Act, and ISACA AAISM — and cleared internal audit. Translates technical and regulatory complexity into Board-ready communication, leads teams through high-pressure incidents, and has built consulting practices and presales functions from scratch. Certified NSA IAM/IEM and CNSS 4011–4016.

Education

Master of Business Administration, Information Assurance
University of Dallas, Irving, TX

Bachelor of Arts, History
University of Texas at Arlington, Arlington, TX

Professional Certifications

NSA IAM/IEM — INFOSEC Assessment Methodology and INFOSEC Evaluation Methodology.

CNSS 4011–4016 (full series):

NSTISSI-4011: Information Systems Security (INFOSEC) Professionals
CNSSI-4012: Senior Systems Managers
CNSSI-4013: System Administrators
CNSSI-4014: Information Systems Security Officers
NSTISSI-4015: Systems Certifiers
CNSSI-4016: Risk Analysts

Professional Experience

Stage Four Security, Plano, TX January 2019 – Present

Founder & Fractional / Virtual CISO · Advisory Partner

Founded and operate an independent Fractional CISO / Virtual CISO advisory practice. Engage client leadership to identify opportunities, shape solutions, and deliver security, GRC, and AI governance program design across a portfolio of regulated clients, standardized to NIST and ISO/IEC 27001. 98% client satisfaction over seven years.
Developed NIST, ISO/IEC 27001, and SOC 2-aligned GRC frameworks; reduced compliance risk through automated controls and vendor risk assessments.
Architected AWS-based environments with Zero Trust Network Access (ZTNA) and IAM; led enterprise risk assessments that closed control gaps and raised client security scores.
Recruited and mentored multicultural consulting teams; built an inclusive practice culture with high retention.

Stage Four Institute, Plano, TX January 2025 – Present

Founder & Executive Director

Established a cybersecurity education and outreach platform. Developed GRC workshops that have trained 100+ professionals in NIST and ISO/IEC 27001 frameworks.
Published thought leadership at stagefour.org, blending cybersecurity practice with policy discussion.
Consulted with K-12 institutions and fostered partnerships with academic institutions to widen access to practical security education.

Lennar Corporation, Irving, TX January 2025 – August 2026

Lead, Cybersecurity Governance, Risk & Compliance (GRC)

Served as GRC Team Lead within Lennar’s Cyber Security organization across Homebuilding, Mortgage, and Title. Directed policy development and review, enterprise risk assessments, control testing, remediation prioritization, budget management, and resource allocation. Aligned the program to NIST CSF, ISO/IEC 27001, SEC, GLBA, privacy law, and related frameworks.
Authored and deployed AIMS v2.0, Lennar’s enterprise Artificial Intelligence Management System, from scratch: full AI lifecycle governance, agentic AI controls, model and agent registry, risk-tiering with go/no-go deployment criteria, governance workflows, incident response, acceptable use, TEVV (Testing, Evaluation, Verification & Validation), secure development and deployment, and third-party AI vendor oversight. Aligned to NIST AI RMF, ISO/IEC 42001, the EU AI Act, and ISACA AAISM. Passed internal audit in 2025 — one of the most substantial governance artifacts in Lennar’s security ecosystem.
Built automated risk-assessment agents into an agentic workflow for AI vendor and tool onboarding, replacing manual review with production-embedded, auditable automation. Applied Python and agentic workflow design directly to production enterprise systems.
Created the full AI policy suite, including AI Acceptable Use Policy and Common Criteria overview, and a structured Confluence information architecture for enterprise adoption.
Led and supported cyber insurance renewal responses for the 2026 cycle, including policy-based interpretations for biometrics and tracking technologies; clarified compliance posture, reduced misstatement risk in insurer filings, and coordinated with GRC leadership and the CISO.
Coordinated PwC-recommended modernization of Lennar’s Information Management & Cybersecurity Policy: data governance, retention standards, policy benchmarking, and gap analysis against compliance deadlines.
Partnered with the CISO and cross-divisional Engineering, in an Agile-style environment, on internal audit, SOC 2, NIST, and Kroll penetration-test remediation — including VDI and Citrix access-control compliance, evidence gathering, root-cause analysis, and control adjustments.
Authored and edited Board-facing risk materials, including the Board Risk Overview (December 2025), translating technical, security, and AI risk into business terms for executive decision-making.

JPMorganChase, Plano, TX January 2024 – December 2024

Vice President, Risk Assurance · Cybersecurity Technology Controls Findings Management

Delivered independent second-line technology risk oversight and challenge of first-line technology risk under OCC Heightened Standards in a G-SIB environment requiring audit-grade documentation and analysis.
Led the Cybersecurity Technology Controls Findings Management program: analyzed security trends, managed control gaps, and drove remediation of technology-control findings.
Managed a team of analysts; translated complex technology risk into business terms for C-suite leaders; delivered executive risk briefings with full stakeholder approval of remediation strategy.
Applied Zero Trust IAM and evidence-based validation (logs, metrics, architecture, operational documentation) against documented policies and regulatory requirements.

CoreLogic, Dallas, TX January 2022 – December 2023

Principal, Corporate Information Security

Managed junior security analysts while conducting infrastructure security risk assessments for fintech operations in cloud-hosted production environments.
Secured AWS infrastructure with IAM and network segregation; advised on infrastructure security strategy and business continuity.
Implemented SIEM-centered detection aligned to NIST, reducing incident response time through improved threat-detection processes, logs, and metrics.
Supported RFP and strategic-vendor security responses and customer assurance with operational evidence.

Unisys, Dallas, TX January 2017 – December 2018

CISO Advisor, Consulting Senior Manager

Served as a client-facing security advisor to a global insurance company. Developed GDPR-compliant privacy and data-protection policy and SOX-compliant control frameworks across international engagements.
Aligned cybersecurity solutions to client needs in collaboration with sales on strategic proposals; contributed to $5M+ in contracts.
Streamlined audit workflows using GRC tools, cutting preparation time and improving readiness.
Led client workshops on phishing and threat awareness covering adversarial tactics, techniques, and procedures.

Sirius Computer Solutions, Dallas, TX January 2011 – December 2017

Managing Security Consultant (2015–2017) · IT Consultant / Security Solutions SME (2013–2015) · Enterprise Security Architect (2011–2013) · Ethical Hacker

Served as an ethical hacker conducting hands-on adversarial testing and TTP-based analysis to identify vulnerabilities and control weaknesses across enterprise client environments.
Consulted on threat intelligence across multiple years: threat-landscape analysis, emerging-risk prioritization, and defensive-posture improvements for regulated-industry clients.
Founded a metadata-leakage consulting practice from the ground up — identified the market opportunity, shaped the offering, sold it into enterprise clients as part of a presales / go-to-market function, and built a proprietary metadata analysis tool to support the practice.
Served as incident commander for the firm’s Heartbleed (2014) vulnerability response across more than a dozen enterprise clients, directing cross-functional response and executive/customer communication during a live, global-scale crisis.
Led consultant teams delivering risk assessment, controls testing, and governance-framework engagements (NIST, GDPR) in Agile-style, cross-functional environments. Supported FedRAMP authorization work.
Oversaw $10M+ IT infrastructure and security programs; served as an agile coach; authored white papers that positioned Sirius as a compliance leader.

University of Dallas, Irving, TX January 2014 – December 2018

Adjunct Professor of Technology Management

Taught graduate-level quantitative risk measurement, KRI/KPI design, threshold calibration, executive risk reporting, technical data capture and analysis, GRC, and technology management to 200+ students.
Integrated real-world case studies; fostered an inclusive classroom; 95% course satisfaction.

CVS Caremark Corporation, TX January 2007 – December 2011

Senior Analyst, Information Security Regulatory Compliance (2010–2011) · Security Shared Services (2009–2010) · Security Monitoring and Policies (2007–2009)

Built the enterprise GRC platform and IAS/SOX/SOD compliance engine from the ground up — system architecture, workflows, and evidence-management logic — at Fortune 7 healthcare scale. Not vendor administration.
Built and maintained SOX IT General Controls testing and evidence management for SAP-based financial systems and IAM clusters.
Led a separate development team building an Identity and Access Management platform from the ground up.
Achieved PCI-DSS, SOX, and HIPAA compliance across hundreds of pharmacy locations and clinical systems. Direct point of contact for external auditors. Led SOC audits with zero major findings over three consecutive years. Scope: retail pharmacy / PBM compliance — not clinical trials.
Trained 200+ employees on security awareness; increased compliance adherence and built a risk-aware culture. Streamlined SOX control testing using GRC tools.

NEC Unified Solutions, Irving, TX January 2006 – September 2006

Network Security Consultant

Implemented network security policies and architecture; reduced vulnerabilities through firewall and IDS/IPS configuration and control testing.
Conducted risk assessments and supported client engagements that improved operational resilience.

The Broadlane Group, Dallas, TX August 2005 – November 2005

IT Governance Consultant

Developed IT governance frameworks for healthcare clients; conducted HIPAA-aligned compliance audits and advised on IT strategy.

Internet America, Dallas, TX January 1998 – December 2005

Security Analyst / Policy Enforcement

Developed and managed Airscreen, a web and mail filtering product built for ISP customers — direct, hands-on software product development.
Enforced security policies on a large-scale service platform; reduced unauthorized-access incidents through monitoring, logs, and vulnerability assessments. Supported IT operations for thousands of users.

University of Texas at Arlington — Engineering Television, Arlington, TX January 1994 – December 1998

Technical Director & Webmaster

Managed IT and media-delivery systems for educational television; developed web platforms; led technical teams and improved content-delivery efficiency.

Core Skills, Technologies & Platforms

Governance, Risk & Compliance platforms

Engineered the enterprise GRC platform and IAS/SOX/SOD compliance engine at CVS Caremark. Hands-on: AuditBoard, OneTrust, ServiceNow GRC, RSA Archer. Reporting: Power BI, Tableau.

AI governance & responsible AI

AIMS v2.0 in production at Lennar. Agentic AI controls, model/agent registry, risk-tiering, automated risk-assessment agents, third-party AI vendor oversight. Standards applied: NIST AI RMF, ISO/IEC 42001, EU AI Act, ISACA AAISM, OWASP LLM Top 10. Python used for automation and agentic workflow design.

Security & risk frameworks

NIST CSF, NIST SP 800-53, NIST AI RMF, ISO/IEC 27001, ISO/IEC 42001, SOC 2 Trust Services Criteria, SOX ITGCs, PCI-DSS, HIPAA (Privacy, Security, and Breach Notification), GDPR (authored policy for a global insurer at Unisys), FedRAMP (supported authorization work at Sirius), GLBA, SEC cyber disclosure.

Identity & access management

Led the team that built CVS Caremark’s IAM platform from the ground up. Identity lifecycle, provisioning, access-management program direction, Zero Trust / ZTNA, AWS IAM, Microsoft Entra ID.

Adversarial security, threat intelligence & incident response

Ethical hacker at Sirius. TTP analysis. Threat-intelligence consulting. Incident commander for firm-wide Heartbleed response across 12+ enterprise clients. SIEM (Splunk), EDR (SentinelOne), vulnerability management (Nessus, Qualys, Rapid7, Wiz), privileged access (CyberArk), email security (Mimecast).

Audit, assurance & regulatory examination

External-auditor point of contact at CVS Caremark; three consecutive SOC cycles, zero major findings. Second-line technology-risk challenge at JPMorganChase under OCC Heightened Standards. Empirical control validation from evidence, logs, and operational documentation. First-line program ownership at CVS Caremark and Lennar.

Consulting, practice-building & delivery

Founded metadata-leakage practice at Sirius, including a proprietary analysis tool. Founded and operate Stage Four Security (seven years) and Stage Four Institute. Agile-style cross-functional delivery. Jira. Budget management and resource allocation. Executive and Board communication.

Industry domains

Healthcare / retail pharmacy-PBM (CVS Caremark). Banking / G-SIB (JPMorganChase). Insurance (Unisys). Real estate / homebuilding (Lennar). Fintech (CoreLogic). K-12 and graduate education (Stage Four Institute; University of Dallas). Multi-industry consulting (Sirius).

Publications & Thought Leadership

Blog: jameskay.online

Authored 50+ essays blending politics, policy, technology, Texas history, and musicianship from a conservative, federalist viewpoint, reaching 10,000+ readers annually.
Themes of limited government, states’ rights, individual liberty, and the intersection of technology and civic order.

White papers & workshops

Authored white papers at Sirius (2011–2017) and Stage Four Institute (2025–present).
Led GRC workshops at Stage Four Institute on ISO/IEC 27001 and NIST.

Professional Affiliations & Activities

Stage Four Institute (2025–present): Founder, advancing cybersecurity education through workshops and publications.
Stage Four Security (2019–present): Founder and Fractional CISO.
X (@James_K_Bishop): cybersecurity, governance, and policy commentary.
Industry forums: conferences and working sessions on GRC and risk-management practice.

Unified Bio Context

A devoted family man and strategic thinker, I blend a passion for baseball, music, and Texas history with a relentless drive to secure technology ecosystems. As a bassist and tenor I perform in local venues. A Texas Rangers fan. My career reflects a commitment to integrity and useful systems — platforms and policies that actually operate, evidence that survives audit, and risk language executives can use. I write at jameskay.online.