For a likely, look into Pitt. They’d weigh his test scores equally with GPA&rigor and that’d be in his favor. They have rolling admissions so if you apply ASAP you should hear soon. There’s an Honors college, too.
Penn State is highly thought of in cybersecurity and similar fields AFAIK but they weigh GPA × rigor much more than test scores so it’s a low reach rather than a likely compared to Pitt, unless he checks “summer start” (ie., bridge session in July with a cohort of 24 taking the same 2 classes, an RA who plans field trips etc) which would make it more a toss up.
If those are too far, UOregon+Honors would be a great possibility closer to home, UO likely and Honors a reach.
UMN Data Science could be another target.
What about WPI? Lafayette? Lehigh?
Some colleges would likely know your HS and its rigor so that reputation+test score should mitigate the GPA at some of the smaller or private colleges.