Dwight G.

I am a mid level to senior cybersecurity professional with 7+ years of hands-on experience delivering penetration testing, vulnerability assessments, risk analysis, and compliance-driven security programs for commercial, enterprise, and government environments. I help organizations find real security gaps, reduce risk, and meet regulatory requirements—without unnecessary complexity or vendor lock-in. Team Gala_Layo's background spans offensive security (Red Team), defensive controls, cloud security, identity & access management, and governance frameworks including NIST, ISO 27001, HIPAA, PCI-DSS, FedRAMP, and CMMC etc...I specialize in translating technical findings into executive-ready risk insights that drive action. I am the President and Technical Lead at Gala_Layo, a cybersecurity firm trusted by federal agencies, regulated industries, and high-risk organizations. What I Do Best ============ Penetration Testing & Ethical Hacking --------------------------------------------- * Network, web application, API, wireless, and cloud penetration testing * OWASP Top 10, SANS Top 25, manual exploitation & validation * Tooling: Metasploit, Burp Suite Pro, Nessus, Nmap, OpenVAS, Aircrack-ng, Wireshark * Actionable reports with proof-of-concept, risk scoring, and remediation guidance Vulnerability & Risk Assessments --------------------------------------- * NIST-aligned security risk assessments * Vulnerability scanning & continuous risk scoring * Risk registers, POA&M development, and control gap analysis * STIGS Tools: Tenable.sc, Qualys, Rapid7, ServiceNow GRC, RegScale Cloud & Identity Security ------------------------------ * AWS & Azure security posture reviews * IAM, MFA, SSO, and privileged access reviews * WAF and cloud security configuration audits Tools: Okta, Azure AD (Entra ID), Auth0, CyberArk Governance, Risk & Compliance (GRC) ---------------------------------------------- * NIST RMF, NIST CSF 2.0, ISO 27001, HIPAA, PCI-DSS * FedRAMP, CMMC, FFIEC, GSA compliance support * Policy, SOP, and incident response plan authoring * Change Control Advisory Board (CAB) experience AI & Emerging Technology Security ------------------------------------------- * Secure-by-Design and MLSecOps advisory * AI risk assessments & Responsible AI impact analysis * Prompt injection & LLM threat modeling * Integration of AI into security workflows safely and responsibly Industries Served --------------------- * Government & Federal Contractors * Healthcare & Life Sciences * Financial Services * Cloud & SaaS * Critical Infrastructure * Small & Mid-Sized Businesses (SMBs) Tools & Technologies ------------------------- * Operating Systems: Kali Linux, Ubuntu, Windows, macOS * Languages: Python, JavaScript, Shell * Security Tools: Nessus, Burp Suite, Metasploit, Rapid7, Qualys, Splunk * Cloud: AWS, Azure * Dev & Code: GitLab, VS Code, Snyk, SonarQube * Virtualization: VMware, VirtualBox Certifications & Education ------------------------------- * Certified Ethical Hacker (CEH) * CompTIA Security+ Security Clearance ------------------------ * Top Secret Education ------------ * M.S. Information & Communications Technology – Information Systems Security University of Denver (GPA 4.0, magna cum laude) Why Clients Hire Me ------------------------ ✔ Real-world offensive & defensive experience ✔ Clear, business-focused reporting (not scanner noise) ✔ Deep federal & regulatory knowledge ✔ Ability to explain complex risks to non-technical stakeholders ✔ Trusted advisor—not just a tool operator Typical Projects ------------------- * Penetration Testing & Red Team Engagements * Vulnerability Assessments & Risk Registers * NIST / ISO / HIPAA Readiness Assessments * Cloud Security Reviews (AWS / Azure) * Incident Response Planning & Tabletop Exercises * AI & Emerging Tech Risk Assessments