While degrees are not required for doing a good job It is also likely you would not go to a doctor without one, A organization is interested in accountability

While degrees are not required for doing a good job It is also likely you would not go to a doctor without one, A organization is interested in accountability degrees provide that validation to some extent. A degree does not mean anyone is fully qualified for a job just as not having a degree does not mean he cannot do it. The damning part in Equifax is that CISO did not have any prior experience in this domain (likely your friend has worked as developer before)