Security engineering for federal programs and commercial teams.
I’m Greg Gutman. I take ISSO / AISSO / SCA coverage, ATO and NIST 800-53 work, cloud and network architecture, and scoped assessments — as a 1099 or W2 contractor, a sub to a prime, or a short fixed engagement. No company paperwork in the way: you hire me.
Reply typically within one business day. CONUS / remote. Public Trust background. Current certifications: CISSP and CASP+.
Two doors, same engineer
Say which seat you need. The work is the same quality; the packaging is different.
Federal programs & primes
Contract coverage
Staff a gap or a surge without standing up a vendor vehicle. Typical work: control implementation and assessment, SSP / POA&M / evidence, GRC platform work, cATO readiness, Xacta-style packages, GovCloud architecture.
A week of architecture review, a control-gap pass, hardening help, or a small engineering build — without a six-month SOW. Useful when you need a senior pair of hands, not a retained firm.
ATO path, not slideware
Helped systems reach and renew authorization, including AWS GovCloud-hosted FISMA systems.
GRC and continuous authorization
AISSO / SCA work, GRC platform migration, SSPs, POA&Ms, and cATO readiness on DOI-supporting programs.
800-53 r4 → r5 in Xacta
Migrated control implementations, SSPs, and evidence for multiple FedRAMP / FISMA systems.
Green scorecards and assessments
Security engineering and SCA work on CONUS federal programs, including DHS- and DOI-supporting systems.
Architecture that survives review
Network, cloud, and TIC-aware design with the documentation assessors actually ask for.
Transport someone has actually run
Enterprise LAN/WAN, fiber, and SATCOM O&M in 24/7 CONUS and OCONUS environments — classified and unclassified — before the cloud years.
How an engagement starts
1. Send the problem
Email or WhatsApp with the track (federal or commercial), timeline, and what “done” looks like. A paragraph is enough.
2. Scope in writing
I come back with a proposed duration, rate or fixed fee, and what I will not do. No sponsorship pitches, no retainers unless you want one.
3. Work, then a clean handoff
You get artifacts your team can keep: notes, control language, diagrams, or working code — not a lock-in report.
Ready to talk?
Use the address and number below. The contact page can pre-fill a message if you want structure.