0:00:01 Bailey Popp: Hello and welcome to another episode of our Security Visionaries podcast. A podcast where we hear incredible stories and advice from thought leaders who are on the front lines tackling risks and challenges across the networking and the cybersecurity space. I'm your host, Bailey Pop, and I am joined today by Kirk Ball, who is the CIO at Worldpay. Welcome, Kirk.
0:00:22 Kirk Ball: Thanks, Bailey. I appreciate the opportunity to spend some time with you and your audience today.
0:00:26 Bailey Popp: Yeah, absolutely. So usually we just kind of ask our guests to give a little bit of an intro to start. So I'd love to hear from you a little bit about your background and your career path and then what you're doing currently at Worldpay.
0:00:39 Kirk Ball: Yeah, sure. So on a three time CIO and a three time CTO across a pretty diverse group of industries, so healthcare, manufacturing, global manufacturing, FinTech payments, Worldpay, and then retail with Kroger and with Giant Eagle. So I have been blessed to work across a number of industries and some really great companies, so tried to make sure I got a chance to spend time having responsibility in technology across a number of different roles from, I've written a lot of code done systems, architecture, enterprise architecture, project program management, kind of work, so on and so forth. So worked in the application and the infrastructure spaces. So yeah, it feels like I've been doing this a long time.
0:01:26 Bailey Popp: So I think one of the things that I always think about when we're thinking about CIOs is you have a lot of decisions to make, you have decisions to make now, but you also have decisions that you have to be thinking about all the way down the line, maybe three to five years. So if you could look into your crystal ball, what is one decision that you make today that you think would define your legacy as a CIO?
0:01:50 Kirk Ball: I think there's lots of different dimensions to being A CIO. It's playing at seven levels of chess most days. You have lots of different things you have to think about, whether it's business implications of the decisions that you make, organizational implications, customer implications, but the most important thing as far as legacy as A CIO I think is the decisions that you make around the talent that you work with, the talent that you hire and how you work to grow and develop that talent. I think it's about the decisions that you make around people, and I think it's around the decisions that you make around the type of culture that you want the team to have and certainly the CIO doesn't set the culture, but the CIO is kind of more like a director of an orchestra and helps get making sure that all the right pieces are in place, everybody understands their role, everybody knows the timing in which they need to participate in the making of the piece of music, and so I really think it's the most important decisions are around culture and around talent.
0:03:01 Bailey Popp: It sounds like you lead with a lot of empathy. What's advice that you would give to other CIOs who are looking to build teams with as much empathy and as much trust as you're driving across all of your different partners?
0:03:14 Kirk Ball: I think for me, I try to make sure that I have a personal connection with the folks that I work with and not just direct reports, but folks that are part of the broader bigger team. I try to understand do they have a family? What's the makeup of their family, what are their aspirations, et cetera, and have that personal connection. But with that personal connection comes the responsibility to help inspire hopefully and hopefully find that right balance between being assertive and pushing the organization to where it needs to go, and making sure that as you're pushing and as you're helping the organization move from point A to point B to point C, that you're doing it in a way that the whole organization and the team appreciates.
0:04:05 Bailey Popp: Absolutely. I love when you talked about finding a personal connection. I don't know why the first thing that just popped in my mind is going golfing or going to a teammate's soccer match to go watch kids play or something like that, but finding that personal connection to people on your team is so important.
0:04:21 Kirk Ball: Yeah, it's interesting. I'll give you an example. We opened a global capability center with one of the companies I worked with in the past in India, and one of the things that really solidified the relationship is when I went over there, we played a three hour cricket match. It was a great way to get close to the team. It was a great way to see what they loved to do. It was a great way to have them teach me. I was not the teacher, I was not the senior leader, they were the senior leaders. They were teaching me how to play, and I still talk to some of those folks today and we still talk about playing that cricket match. So it's just a good example of how to find that way to connect with the team.
0:05:01 Bailey Popp: Did you win?
0:05:02 Kirk Ball: I can't tell you if I won or not, but I had a lot of fun.
0:05:05 Bailey Popp: Oh, that's all that matters at the end of the day. Speaking of your team, you're in charge of delivering quarterly results, but also thinking about your long-term risk management. So what's a piece of advice that you would give to fellow CIOs who face that every single day as well? It sounds like you've struck a really good balance, so I'd be curious to hear a little bit more.
0:05:28 Kirk Ball: Yeah. I'm a very strong believer in the architecture discipline. I think as you go to build skyscrapers, you better make sure that you have your blueprints. The blueprints have been reviewed, they're solid, you've made wise decisions as far as the materials that you're going to use to build the skyscraper, the way that you're going to build the skyscraper, the approach, and then once you build the skyscraper, typically you have far fewer problems. Your risk is significantly lowered. Now, certainly you have to balance that architecture discipline with the pressures of time and the pressures of delivering solutions at a pace that matters to the business. But I am a big believer in making sure that you design before you build as much as you can and you drive standards so that you have standardized tools that people get used to using, and I think that's a really good way to at least reduce build risk. Certainly risk comes in all kinds of forms and factors, whether it's external risks from folks that are trying to do damage to your company, risk comes in terms of in the form of acquiring the right talent, retaining the right talent. So there's a number of different areas that risk comes, and I think you have to be working with those that you work with directly, the team in the whole to make sure that you're addressing and you're aware of the different avenues from which risk can present itself and that you have plans and an approach to manage the risk regardless of what type of risk that it is.
0:07:04 Bailey Popp: That's great advice. How are you thinking, I love the design and build concept and it varies across all the different industries that you worked in. So how do you think about your risk approach specifically within financial services at Worldpay?
0:07:17 Kirk Ball: Certainly within financial services, it's certainly, and I've also worked in healthcare and both of those, just every company has tons of risks that they have to manage this. Certainly in healthcare and in financial services, risk is a significantly elevated discipline and we make sure that we build in design principles that help us manage that risk. So separation of duties, protecting clients, personal information, making sure that we have strong safeguards as we look to move money from point A to point B, validating that what we thought we were delivering got delivered. So building into our tools and our processes, risk management approaches that allow us to guarantee the integrity of what we're trying to do or guarantee the integrity of the data guarantee the integrity of the transaction, having those predefined design considerations in place really helps us effectively manage the risk. And then clearly we do lots of different audits. We do lots of different validations to make sure that the design principles and the processes that we put in place are being followed. They're being delivered in a fashion that minimizes risk and we constantly measure and meter that.
0:08:37 Bailey Popp: It's really interesting because I heard digital risk in there, but I also heard physical security risks as well. So you're balancing both of those. I think that that's something that a lot of people probably that doesn't come top of mind when you're thinking about cybersecurity risk within the industry. You have to account for that physical risk as well.
0:08:55 Kirk Ball: You sure do.
0:08:57 Bailey Popp: Speaking of cybersecurity, technical concepts, when you're communicating to the board, how do you actually communicate your value or how do you change minds in there or talk to people that might not have the technical background that you do? What's the story that you tell?
0:09:15 Kirk Ball: The most effective CIOs that I've seen in front of the board and that I've tried to emulate are folks that get into board conversations and they don't talk at a zero and one bits and bites level. They don't go in talking about the beauty of the architecture of the solution. They go in talking about how a solution addresses a business need, what's the risk to getting the delivery done on time and on budget, and once the solution is delivered, did it add the business value that the enterprise needs? Because the board members are primarily thinking about, they're not thinking about the elegance of a technology solution. They're thinking about some, do you get some board members that are technically pretty technically astute, but most of them are really, really focused on the outcome of the technology implementation or the risk management or the cybersecurity posture. They're really thinking of it from the integrity and the value to the business, and so learning how to tell a story from their perspective, you can get your story across and get your points communicated effectively that I think you do it if you do it from the paradigm of how they're listening and what their value system is and what's important to them. It seems to be much more effective. When I first started talking to board folks, I sometimes would fall into the trap of going in and being very enamored with the technology solution and the technologies we were using, and it was kind of like staring at a group of folks that are looking, you can see the bubbles over top of their head going, what's he talking about? So it's very much more, in my opinion, much more effective to tell this story that you're trying to get across from their perspective. And when you tell it from their perspective, it usually is much more effective and resonates,
0:11:09 Bailey Popp: Speak their language.
0:11:11 Kirk Ball: That's right. And what's important to them. They're trying to make sure that the company's successful. They're trying to make sure that the company is secure from a cyber perspective. They're trying to make sure that the new features and functions that the technology delivering is having an impact positively with the customer base and that revenue is growing and that you're managing expenses effectively. And if you can tell the story from some of those perspectives and maybe a few others, it's usually much more effective.
0:11:39 Bailey Popp: Do you have an example of one of those compelling stories? You felt so passionate that this was something that you needed to do for the business or we needed to do for the business, and you went in there guns a blazing, ready to get the board on your same page. Do you have an example of that?
0:11:55 Kirk Ball: Yeah, I've got a couple of examples that one of the companies I was with, it was maybe not the sexiest story, but we had a supply chain platform that was in dire need of refreshing and replacing, and we talked about the antiquity of the servers, the antiquity of the software. It became very effective when we talked about what was the potential risk implications to being able to move product from distribution centers to stores, from suppliers to distribution centers to stores. Then it started resonating and as we started to tell the story from a risk perspective, it made all the difference and we got it over the line. Another story I'll tell you is we went to implement a digital customer strategy at one of the companies that I worked at. We had a senior leader that for whatever reason did not see the value of being digitally engaged with our customers, and we finally, we did presentation after presentation. We had various senior leaders around the enterprise pushing the CEO to allow us to put together a strategy and the subsequent execution approach, but we finally said, you know what? Let's make this a visual thing and not a presentation. We put together about a 15 minute vignettes, a set of vignettes with actors showing how those families, the moms, the dads would interact with the company using digital capabilities and how that eliminated friction from their experience and their life and how it drove greater loyalty and affinity for our company. In that 15 minute set of vignettes made all the difference in the world, he got it. And then at that point, we put together a strategic approach with more like a startup where we had a series A plan if we successful on our series A delivery, we got the series B funding then on the C and D, and we got through all of those different series and it's turned into a multi-billion dollar business for the enterprise. But sometimes that visual and telling a story visually is also very, very effective.
0:14:18 Bailey Popp: That is a really, really cool story. You took the human element and you kind of tugged at the heartstrings a little bit to show how your business plan was going to map back. I think that's so cool. I'm going to bookmark that strategy actually in my back pocket.
0:14:33 Kirk Ball: Yeah, it was just impactful for him to see the end impact that it would have on customers' lives.
0:14:39 Bailey Popp: One of the other things that is top of mind for any C-suite executive in the boardroom is compliance. You get peppered with all of these different regulatory standards and questions and audits. So what are leadership habits that you've turned to help kind of combat some of that stress and pressure when it comes to the regulatory world?
0:15:02 Kirk Ball: Well, certainly I think making sure that you and the organization that you work with understand the regulatory and compliance disciplines and guidelines that you need to make sure that the organization is following. Secondly, I think you have to model the way you have to ensure that your behavior exhibits and demonstrates how important that your personally taking regulatory and compliance issues. Then we've put in place systemic mechanisms to regularly review how our operations, how our solutions are adhering to regulatory and compliance guidelines. And then subsequently, we do certainly a number of audits. We take those audits very seriously. We report audit results to the board and we identify where we have anomalies or things we need to address, and then we put in place objectives to remediate any findings, and then we are very serious about getting those items closed and reporting back to the board on a regular basis.
0:16:04 Bailey Popp: Absolutely, and another hot topic that's everywhere is ai. What is one assumption that CIOs need to challenge about AI right now?
0:16:15 Kirk Ball: I think AI is an organizational opportunity. I think a lot of times when at least in the past when I've seen technologies come out, the business partners look at the ccio O and go, what are we going to do? I think the first most important thing that A CIO can do is to help senior leaders across all aspects of the business really understand what is ai, what can AI do? What are the possibilities of ai? Whether it's allowing and enabling greater productivity within the context of an organization, whether it's allowing a customer or a set of customers to interact with you and get information in a more effective and efficient fashion. I think you have to make sure that the senior leaders across the organization understand what the possibilities are. I think providing them with some real world use cases, I think getting them out to visit with companies that are implementing AI or that have AI technologies and letting them see. And then I think the challenge is determining where you're going to place your bets as a company. With AI, in theory, AI has a lot of applicability across an enterprise, whether it's external facing and interaction with customers or whether it's internal facing and productivity. How do you make sure you get your organization employee, your organization's employees on board, but to have a clear cut strategy, really know what you're going to go after and determine what use cases you're going to invest in. You can't invest in everything all at once, and you want to make sure that what you do is successful and that it enhances your employees' lives or enhances your customer's experience. But I think that's a decision. Those sets of decisions have to be made at a business level, and so I think the CIO has a responsibility to educate, teach, and expose, and then I think help the business make the decisions on where are the right places to put the scarce resources to address the implementation of ai. So it's successful.
0:18:21 Bailey Popp: Yeah, it goes back to your earlier concept design and then build. Think about all of the components that the AI is going to touch and then build your program based on the priorities and the use cases from there.
0:18:35 Kirk Ball: And I think a little bit of proof of concepting, a little bit of piloting can make a difference. You may think that particular application of an AI capability in a given space may add value, but if you do a little bit of piloting and proofing a concept, you can validate that your thoughts about value were correct. In some instances it might not be correct. So before you invest a ton of time and energy and taking something all the way to production, it's best to try and do a little bit of proof of concepting, in my opinion, but do it pretty quickly. Right?
0:19:08 Bailey Popp: Yeah.
0:19:09 Kirk Ball: Look, I think there are companies that are utilizing AI to drive productivity, but I think there still are a lot of companies that are trying to figure out how to apply AI, and I think you have a decision to make. Do you leverage external products that provide AI capabilities? Do you try to build your own models and train them and then do the application of the models that you've trained? Do you build your own capability? Do you buy your own capability? A combination of the two? I think those are all important decisions that you have to make, but I think there are a lot of companies still trying to figure it out.
0:19:45 Bailey Popp: Yeah, it's a tough road to navigate and it's only going to get harder as well.
0:19:50 Kirk Ball: It's one I don't think companies have a choice not to engage in. I think you have to engage in in the exploration and the investigation and the proof of concepting of AI to see what's going to work for your business model.
0:20:04 Bailey Popp: Yeah, it's like the thing before that was cloud and now it's AI, and then the next thing will be quantum, and if you're not on board, you're getting left behind. That's right. Yeah. What's the scariest thing about AI to you as a CIO?
0:20:19 Kirk Ball: Yeah, that's a big question.
0:20:22 Bailey Popp: I just thought of that one.
0:20:24 Kirk Ball: I don't think AI is something to be scared of. I think AI is something to effectively manage. I think one of the key things, I think that as you go to implement AI within the context of your company, I think you have to make sure that you're very clear with employees and associates, how is this AI going to help drive hopefully improvement in the way that they do their work. As soon as you mentioned, not as soon as, but in a lot of instances when you mentioned the term AI, people start to immediately jump to, it's going to take my job away. And I think you have to be very clear to identify what you're trying to accomplish with the AI capability that you're implementing and hopefully drive an implementation that is an augmentation of the employees and what they do. Hopefully not a complete replacement, at least if you want to get those in the organization on board, I think that's a very important aspect of how you implement and introduce AI capabilities to your enterprise. In some instances, it will replace jobs, there's no doubt about that, but it's not necessarily all doom and gloom. I think there's a lot of instances and examples where you see that AI's been implemented in companies and it helps enhance the way that employees do their work and it helps them be more productive. So I think that's a big topic to think about how you introduce AI to your organization.
0:21:48 Bailey Popp: Yeah, keeping that human in the loop is still important. It can't go all one way or all the other.
0:21:54 Kirk Ball: Yeah. There's a really good book I read long ago, and it's looking into the future, it's called "Rise of the Robots and the Prospect of a Jobless Future." You hear prognosticators talk about, well, in the future as AI gets highly proliferated across enterprises, what's the impact on jobs? Will there be job disruption? To what degree, what jobs get disrupted? I think it's very interesting to see what the futurists think, the differing opinions, but I also heard Eric Schmidt talk about in the history of mankind, every major invention, whether it be the steam engine, whether it be the transistor, and certainly there's a number of others, but in every major disruption like that, more jobs have been created than have been lost. And I'm hopeful that we find that eventually over time that that's the case with AI.
0:22:52 Bailey Popp: I would clinging to that hope as well, and I'm going to check out that book. That could be my weekend reading.
0:22:57 Kirk Ball: That's very interesting.
0:22:58 Bailey Popp: Well, maybe to close, if you were to give a piece of advice to a fellow CIO who wants to stay credible and influential and build a brand for themselves within their industry, what would you say?
0:23:11 Kirk Ball: Be authentic and really focus on the success of the company that you're with and your organization and all the organizations that the technology group serves. Helping others understand that you're there to help their success as well, whether it be the folks in marketing or merchandising or supply chain, letting them know that you're highly interested in your organization is highly interested in them, helping them achieve their organization's objectives. I would say certainly be a servant leader. Connect as much as you can with people on a personal level and just be authentic and be very transparent. I think it's incredibly important that you're transparent and that you engage those that you work with for their ideas as well. You don't have to be the all-knowing, all seeing entity that comes up with all the strategies. When I worked at Honda, certainly learned a ton when I went out and talked to folks on the assembly line to understand what they see every day. How effective are the systems that the technology group was delivering for them? Were they really as effective as we thought they were? Once you see them in use on a day-to-day basis and you go ask the people that use the system, it's very, very, you learn a ton. So I think seeking feedback on a regular basis is very, very important as well. So those would be some of the things I would say.
0:24:41 Bailey Popp: Yeah, looking at yourself in the mirror, being authentic with what is facing back at you, and also if it's not working, you're not going to make it seem like it is working. You need to give room to fix things and challenge things, and I think it's so cool that you go and spend time with people on the front lines to assess where things are working and where things aren't. I think that's such a great tip for anyone that's listening.
0:25:06 Kirk Ball: Yeah, I think it's where you learn the most. And again, just be really authentic. People watch you all the time. People see you, they watch your actions, they watch what you do, what you say, and they know if you're authentic or not. And I want to make sure the people that I've always admired the most as leaders are the people that were authentic and that I knew were straight with me. Whether it be giving constructive feedback or positive feedback, I knew it was real. That meant the world.
0:25:35 Bailey Popp: Honesty matters the most.
0:25:38 Kirk Ball: Sure does.
0:25:39 Bailey Popp: Yep. Well, I've asked you a lot of questions today, but anything I didn't ask you that you wanted to share on the podcast today? Anything you're excited about doing next?
0:25:49 Kirk Ball: Yeah, I'm excited about constantly learning. I've been doing this for a long time. I'm taking on some new types of work as I get close to the end of my operating career, I would encourage CIOs, there are seasons of life in a CIO. You've got spring, summer, winter, and fall. And as you get into fall, late fall and winter, you start to think about, okay, well when I'm done with my operating career, what do I want to do next? Do I just want to chill and do my hobbies? Do I want to do a combination of my hobbies and still consult, still advise? Then I would encourage folks to that fall and winter stage of their careers to think about what they want to do next. And if, do you have a desire to do some things beyond just an operating career, prepare, prepare early, build your network, I would tell a CIO that the best thing you can do, one of the best things you can do is build your network. I don't care what season you're in, build your network because you're going to learn a ton from other CIOs and CTOs, what's worked in their organization and what's not worked. So those would be a couple of things I would add.
0:26:56 Bailey Popp: Absolutely, and we are in the winter season right now, that's for sure. It is so cold. Alright, well, I think that that's all we have time for today. You have been listening to the Security Visionaries podcast. I am your host, Bailey Popp. If you enjoyed this episode, you can find it on our new YouTube channel, Spotify and Apple Music subscribe. Give us some love and we will catch you next time. Thanks, Kirk.
0:27:20 Kirk Ball: Thanks Bailey. Stay warm.
0:27:22 Bailey Popp: You too.
0:27:23 Kirk Ball: Bye-Bye.
){kind=icon}
