How does the CSO's multiple degrees in Music convey a lack of knowledge in the domain she was hired for?

It doesn't, because there's no information to derive there. I believe you are attempting to construct an argument that says that an offtopic degree disqualifies her to be a skilled practitioner by default.

This is wrong. The topic of someone's degree has no implicit bearing on their work experience before and after it.

LinkedIn shows endorsements by tens of people at each of her jobs in the specific labels "Information Security", "Disaster Recovery", and "Business Continuity". By that basis, she is perfectly qualified to handle this breach.

Unfortunately, that information - which takes up as much or more screen space on her LinkedIn page than her dual degrees - wasn't considered relevant by the OP, and is being studiously ignored for some unknown reason.