Grand Prairie CIO Talks Cybersecurity and Building a Cloud-First City

Keshnel Penny is the chief information officer for the city of Grand Prairie, where he has led the city’s technology operations since May 2016. He previously served as manager of public safety technology and as a Lawson security administrator for the city.

Penny has more than 18 years of service with Grand Prairie and is a Certified Government Chief Information Officer (CGCIO). He holds a Master of Business Administration, a Master of Science in healthcare administration and a Bachelor of Science in information systems from the University of Texas at Arlington.

IITX: As CIO of your organization, how do you describe your role? How have the role and responsibilities of the CIO changed in recent years?

My role is to make technology a reliable utility for the city while turning data and digital services into measurable outcomes for residents and departments. Over the last several years, the CIO role has shifted from primarily operating infrastructure to leading risk management, modernization, vendor strategy and organizational change. Cybersecurity and resilience now sit at the center of nearly every decision, and the work increasingly requires cross-department governance, clear service ownership and transparent performance metrics.

IITX: In your tenure in this position, which project or achievement are you most proud of?

I’m most proud of building a culture and operating model that lets us modernize safely while still delivering day-to-day reliability. That includes strengthening cybersecurity practices, improving governance, and moving critical services toward a cloud-first approach without disrupting operations. The real achievement is not one system, it is the repeatable capability to prioritize, deliver and sustain improvements across the organization. 

IITX: What projects will you be looking to fund in this budget cycle?

We are prioritizing investments that reduce risk, improve service reliability and modernize core platforms. That includes cybersecurity and resilience improvements, life cycle replacement of end-of-support technology, and modernization work that improves how employees deliver services to the community. A multiyear project to upgrade our radio communication infrastructure. We are also investing in governance and portfolio discipline so that every dollar is tied to outcomes and measurable benefits.

IITX: Grand Prairie was recently recognized for its cloud-first strategy, with 70 percent of systems now cloud-based. What were the key drivers behind that transition, and how are you measuring its impact on city operations?

The drivers were reliability, security maturity, scalability and speed to deliver new capabilities. It also reduces the team's workload by eliminating the maintenance of legacy systems. Moving systems to the cloud is not necessarily cheaper than on-premises systems; however, it does reduce the operational burden on the team and frees them up to do more impactful tasks. We measure impact through service availability, recovery objectives, security posture improvements, and time-to-deliver for new services or enhancements. We also track operational outcomes such as reduced maintenance burden, improved patching cadence, and better visibility into performance and cost.

IITX: What lessons did your team learn while moving from legacy systems to the cloud, and what advice would you give to peer cities that are just starting that journey?

The biggest lesson is that cloud is not only a hosting change, it is an operating model change. Successful migrations require clear application ownership, disciplined identity and access management, strong vendor management, and realistic organization change management for customers. My advice is to start with a prioritized road map, standardize security patterns early, and choose a few high-value wins that prove the model before scaling.

IITX: Your team has started integrating generative AI tools into daily workflows. How have these tools changed internal operations, and what kinds of use cases are showing the most promise?

We are using generative AI as a productivity layer to improve speed and consistency in everyday work, while keeping strong guardrails around data, privacy and responsible use. The most promising use cases include drafting communications, summarizing meeting notes, creating first-pass documents, and accelerating research and analysis. We treat AI outputs as assistive, not authoritative, and we continue to refine governance so the city gains value without increasing risk.

IITX: What big initiatives or projects are coming up? What sorts of developing opportunities and RFPs should we be watching for in the next six to 12 months?

You can expect continued focus on cybersecurity, resilience, and modernization of key business systems and digital services. We are also strengthening governance for intake, prioritization and benefits realization so that projects are delivered predictably and transparently. Some of our opportunities will be in the area of security improvements, cloud optimization, and modern tools that improve employee productivity and the resident experience.

IITX: How do you define “digital transformation?” How far along is your organization in that process, and how will you know when it's finished?

Digital transformation is the continuous work of redesigning services and internal operations so technology, data and process improvements produce better outcomes. We have made strong progress, but it is never "finished." With the rapid changes in technology and platforms, digital transformation is an ongoing process. We don't look at digital transformation as an endpoint, but as a continuous process that must be evaluated, maintained and adjusted in cycles. We measure our transformation by service performance improvement, impactful user experiences, security and resilience stability, and whether departments can adapt quickly without creating unmanaged risk.

IITX: What is your estimated IT budget, and how many employees do you have? What is the overall budget?

Our IT budget is approximately $10 million with 35 employees supporting city operations. The city’s overall budget is approximately $530 million. We focus on linking technology spend to service outcomes, risk reduction and operational reliability.

IITX: What do you read to stay abreast of developments in the government technology/SLED sector?

I consume a mix of technology resources, including peer networks, industry research and public-sector technology publications. I also pay close attention to cybersecurity and AI developments. I prioritize sources that connect technology trends to governance, risk and measurable service delivery outcomes.

IITX: What do you think is the greatest technology challenge in Texas?

The biggest challenge is balancing modernization with rising cybersecurity threats and constrained resource capacity. Local governments are expected to deliver more digital services while protecting sensitive data and maintaining legacy systems that are expensive to sustain. The opportunity is to standardize security practices, modernize responsibly and collaborate across jurisdictions to share knowledge and reduce duplication.

IITX: What advice would you give to someone who would like to lead an IT department?

Lead with outcomes, trust, intent. Learn the business units, communicate clearly and build a team culture that values accountability, service and continuous improvement. In addition, prioritize stakeholder management, build rapport and work to maintain it. Invest early in governance and cybersecurity fundamentals, and focus on education and the "why" behind decisions. Finally, develop leaders at every level, because scale and resilience come from people, not tools.

IITX: How do you prefer to be contacted by vendors, including via social media such as LinkedIn?

Email is best for initial outreach, especially when it includes a clear purpose. LinkedIn is a great resource for connection.

IITX: How might vendors best educate themselves before meeting with you?

Understand our mission, service constraints and public accountability. Review our city priorities, current challenges and the types of outcomes we're trying to achieve. Most importantly, keep it simple.

IITX: What professional or affinity groups do you belong to? Do you volunteer and would you like to share that experience with readers?

I value professional networks that share practical lessons in leadership, cybersecurity and public-sector transformation. I also believe service is part of leadership, so I contribute time and expertise where it can help the community and the profession. I volunteer with a local nonprofit organization that provides STEM outreach and training to kids. I'm also a member of the Texas Association of Governmental Information Technology Managers.

IITX: What conferences do you attend?

I prioritize events that combine leadership, cybersecurity and practical government technology, especially those that emphasize peer exchange and measurable outcomes. I attend the Texas Association of Governmental Information Technology Managers conference. While I attend some of the big-name technology conferences, I really enjoy the smaller, more focused events and the local ones in my area.

IITX: What are you reading or listening to for fun? What do you do to unplug in your downtime?

Outside of work, I enjoy reading and listening to content that broadens perspective beyond technology, including leadership and world history, and science. To unplug, I focus on time with family, rest, running and activities that reset attention and energy.