James K. Bishop, IAM/IEM, CNSS 4011–4016

MBA, Information Assurance

The layers, stacked — not a résumé in another font.

Plano, Texas · Curriculum Vitae · Career Accomplishments

Core Talent Stack Layers

1. Deep cybersecurity, GRC, and platform-building expertise

Core foundation — expert

Frameworks in production: NIST CSF and SP 800-53, NIST AI RMF, ISO/IEC 27001, ISO/IEC 42001, SOC 2, SOX ITGCs, PCI-DSS, HIPAA, GDPR, FedRAMP (supported), GLBA, SEC cyber disclosure, EU AI Act, OWASP LLM Top 10.
Builder, not only administrator: engineered CVS Caremark’s enterprise GRC platform and IAS/SOX/SOD engine from the ground up; led the team that built the IAM platform at Fortune 7 healthcare scale.
Tools in actual use: AuditBoard, OneTrust, ServiceNow GRC, RSA Archer, Power BI, Tableau, Splunk, CyberArk, Mimecast, SentinelOne, Nessus, Qualys, Rapid7, Wiz, AWS IAM, Microsoft Entra ID, Zero Trust / ZTNA, Jira. Python applied to production agentic workflows.
Adversarial and incident work: ethical hacker and threat-intelligence consultant at Sirius; incident commander for the firm-wide Heartbleed response across 12+ enterprise clients.
Audit outcomes that matter: three consecutive SOC cycles at CVS Caremark as external-auditor point of contact, zero major findings. AIMS v2.0 cleared internal audit at Lennar in 2025.
Credentials: NSA IAM/IEM and the full CNSS 4011–4016 series — government-developed INFOSEC depth that is uncommon outside federal and defense-adjacent work.

→ This layer is necessary. It is not the differentiator by itself.

2. Enterprise policy authorship and AI governance leadership

Rare differentiator — top-tier

Authored and deployed AIMS v2.0 at Lennar (January 2025 – August 2026): full AI lifecycle, agentic AI controls, model and agent registry, risk-tiering with go/no-go criteria, governance workflows, incident response, acceptable use, TEVV, secure development and deployment, third-party AI vendor oversight. Aligned to NIST AI RMF, ISO/IEC 42001, the EU AI Act, and ISACA AAISM. Passed internal audit.
Built automated risk-assessment agents into the AI vendor and tool onboarding workflow — production automation, not a slide about automation.
Wrote the AI policy suite (Acceptable Use, Common Criteria) and the Confluence information architecture that made the program usable across Homebuilding, Mortgage, and Title.
Cyber insurance SME for the 2026 renewal cycle: policy-based interpretations for biometrics and tracking technologies; reduced misstatement risk in insurer filings.
Coordinated PwC-driven modernization of Lennar’s Information Management & Cybersecurity Policy — data governance, retention, benchmarking, gap analysis.

→ Few practitioners write an enterprise AI management system that then survives internal audit. Recency in agentic-AI control design is the scarce part of this layer.

3. First-line ownership and second-line challenge — with Board-grade communication

High-impact operating range

First-line-style program ownership: CVS Caremark and Lennar — design, operate, evidence, remediate.
Second-line challenge: Vice President, Risk Assurance at JPMorganChase (2024), independent oversight of first-line technology risk under OCC Heightened Standards, leading Cybersecurity Technology Controls Findings Management.
Board and C-suite translation: author and editor of Board-facing risk material at Lennar, including the Board Risk Overview (December 2025); executive briefings at JPMorganChase with full stakeholder approval of remediation strategy.
Cross-functional leadership with CISO, GRC, Privacy, Architecture, Engineering, Mortgage, and Title. Consulting and presales history that includes $5M–$10M+ program and proposal work at Unisys and Sirius.
Stage Four Security client satisfaction of 98% across seven years.

→ The rare part is fluency in both lines of defense without confusing them. Most people have only one of the two postures.

4. Education, mentoring, and thought leadership

Amplifier

Stage Four Institute (2025–present): GRC workshops in NIST and ISO/IEC 27001; 100+ professionals trained; K-12 consulting; academic partnerships; publishing at stagefour.org.
Adjunct Professor of Technology Management, University of Dallas (2014–2018): graduate quantitative risk, KRI/KPI design, threshold calibration, executive reporting, GRC; 200+ students; 95% course satisfaction.
Security-awareness training for 200+ employees at CVS Caremark; hired, coached, and developed analysts, consultants, and managers in every subsequent seat.

→ Technical depth that can also teach is a smaller set than technical depth alone.

5. Entrepreneurial initiative and business acumen

Ownership mindset

Founded Stage Four Security (2019–present): Fractional / Virtual CISO advisory, program design, client delivery.
Founded Stage Four Institute (2025–present): education and outreach as a distinct mission, not a brochure for the consultancy.
At Sirius, founded a metadata-leakage consulting practice from a market gap — shaped the offer, sold it, built the tool.
MBA in Information Assurance, University of Dallas — business strategy welded to cybersecurity risk, not bolted on.
Direct software-product history: Airscreen, a web and mail filtering product, at Internet America (1998–2005).

→ Risk tolerance and the habit of creating the vehicle when the seat does not already exist.

6. Creative artistry and musicianship

Collaborative edge

Bassist (bass guitar and classical guitar), tenor (lead and harmony), band veteran, songwriter.
Band work is negotiation, promotion, and ensemble delivery under a hard downbeat — the same muscles as a cross-functional control program.
Songwriting is iteration: take the draft, take the note, make the thing resonant enough to keep.

→ Not a hobby paragraph. Stakeholder alignment and framework iteration look like rehearsal if you have done both.

7. Principled storytelling and writing

Personal edge — from the blog and the voice

Blog at jameskay.online: raconteur essays on conservative policy, sovereignty, federalism, and the meeting point of technology and liberty. 50+ pieces; 10,000+ readers annually.
X: @James_K_Bishop — governance, security policy, and civic argument without the corporate fog machine.
The writing habit is the same habit as a Board paper: one clear claim, evidence, residual risk, a decision.

→ Persuasion is the glue. Controls that cannot be explained do not get funded, staffed, or operated.

The Rare Combo

Very few people stack all of these at once:

Federal-grade INFOSEC credentials (NSA IAM/IEM, CNSS 4011–4016) plus deep NIST / AI RMF / ISO 42001 practice
Enterprise AI governance authorship that includes agentic controls and an audit pass
First-line program ownership and second-line G-SIB challenge under OCC Heightened Standards
Platforms built, not only bought — GRC and IAM at CVS Caremark; AIMS v2.0 at Lennar; a metadata practice and tool at Sirius
Education at graduate and professional scale
Two founded organizations still operating
Ensemble collaboration from musicianship
Direct, principled storytelling with a conservative and federalist register

That intersection is useful in a short list of seats:

First-line control management and technology risk inside Engineering at a G-SIB or comparably regulated firm
Enterprise GRC and AI governance leadership in homebuilding, healthcare, fintech, insurance, and defense-adjacent industry
Federal and DoW cybersecurity policy — cryptographic modernization, AI risk, assessment methodology
AI governance advisory after the current executive-order and ISO 42001 wave
Fractional CISO and education work that has to survive both a Board and a classroom