It doesn't mean she didn't know what she was doing, but it certainly looks bad. A company whose CSO doesn't have a technical degree is going to have a harder time proving they took security seriously.
And, then, given that Music is entirely dependent on mathematical principles, and Music Theory especially: What are the chances that, as an MFA in Music, she has a rock solid background in mathematics?
Does that make her choice of degree less distasteful?
Would we be having this conversation if she had no degree? (Of course not.)
Unlikely? There is no standard math requirement for music majors, and that's pretty well known.
> Would we be having this conversation if she had no degree? (Of course not.)
Yes, even more so! A chief security officer with no degree presiding over the security of a nation's credit data?! I mean, she's already under scrutiny because Equifax has been hit by three big stories in the past couple weeks demonstrating their absolute lack of concern for security: the breach, the "random pins", the admin/admin credentials.
"A chief security officer with 15 years of experience and peer accolades in the fields of banking-grade security and human data management"
Typically, this is where most people don't even ask what a degree is. However, as you indicate "no degree" is unacceptable: Which domain-relevant degree programs, initiated 20+ years ago and completed 15 years ago, would satisfy your terms?
You imply that Music is a non-technical degree, which is arguable, but it's certainly an Arts degree rather than a Science degree. If that's the distinction by which you draw the line, you're wrong to do so. If you reject job applicants to a technical role on that basis someday, that's more overlooked high-value opportunities for others to hire instead :)
The odds are near zero. Everyone learns their own domain. Quoting random properties of a specific subdomain of a branch of all possible learning demonstrates your knowledge, not disproves theirs.