Information Security Engineer

About the Company:

Highway is the fastest-growing freight tech provider in North America. We serve the largest freight brokers in the industry, solving one of their biggest pain points: who is really hauling their freight. We answer the question of Carrier Identity, protecting brokers’ networks, preventing fraud and increasing transparency. Serving and protecting our customers is our top priority, and we are proud that our best marketing is our customer referrals and testimonials.

FLSA Status: Exempt

Location: Dallas, TX (This is an onsite position)

Reports to: Chief Information Officer

Status: Full-time

About the role

Highway is looking for an Information Security Engineer who can work comfortably across technical security operations, compliance, and customer assurance. This person will help protect Highway’s systems and data, maintain our security controls, and manage the recurring work required to support our SOC 2 Type II program.

The role combines hands-on investigation and security-process ownership with regular communication across the company and with customers. The right person can examine a security alert or control gap, work with the relevant teams to address it, and explain the issue and our approach clearly to a customer or auditor.

Responsibilities:

Security operations and risk management

• Monitor and investigate security alerts from our endpoint, identity, cloud, and other security tools.
• Triage potential security events, gather relevant evidence, document findings, and coordinate response and escalation with internal teams and external security partners as appropriate.
• Help maintain and improve incident response procedures, investigation playbooks, and security documentation.
• Identify security weaknesses and control gaps, assess their risk, and coordinate practical remediation with engineering, IT, and business stakeholders.
• Support vulnerability management, access reviews, security configuration reviews, and other recurring security activities.
• Help evaluate security implications of changes to systems, infrastructure, applications, and business processes.

Compliance and security assurance

• Manage the SOC 2 Type II calendar, including control activities, evidence collection, reviews, auditor requests, and key deadlines.
• Coordinate with control owners across the company to ensure controls are understood, performed on schedule, and supported by appropriate evidence.
• Maintain accurate and audit-ready control documentation, policies, procedures, risk records, and evidence.
• Track audit findings, exceptions, remediation plans, and other compliance commitments through completion.
• Support customer and vendor assessments and help maintain alignment between security practices and applicable contractual or compliance requirements.
• Apply knowledge of security and compliance frameworks—including SOC 2, FedRAMP, and PCI DSS—to assess requirements, identify control gaps, and support readiness or ongoing compliance activities as applicable.
• Identify opportunities to make compliance activities more repeatable and efficient without reducing the quality of the control environment.

Customer and stakeholder engagement

• Complete security questionnaires and due-diligence requests with accurate, consistent, and appropriately detailed responses.
• Participate in customer meetings to explain Highway’s security program, controls, and practices in clear, confident language.
• Coordinate responses to customer security questions with technical, legal, compliance, and customer-facing teams.
• Help maintain approved security responses and supporting materials so customer communications remain current and consistent.
• Communicate security risks, incidents, and recommendations to audiences with different levels of technical knowledge.

Program improvement

• Recommend and implement improvements to security processes, documentation, monitoring, and controls.
• Help develop security awareness and guidance for employees.
• Stay informed about relevant security threats and practices, and translate them into actionable recommendations for Highway.
• Contribute to a culture in which security is incorporated into day-to-day decisions and operations.

Qualifications:

• Experience in information security, security operations, compliance, security engineering, or a related role.
• A practical understanding of security monitoring and alert investigation, including how to document findings and determine when to escalate.
• Experience supporting SOC 2, FedRAMP, PCI DSS, or similar security assurance and compliance frameworks.
• Strong written and verbal communication skills, including the ability to explain technical security topics to customers, auditors, and nontechnical colleagues.
• Confidence leading or contributing to customer conversations about security without overstating the company’s controls or capabilities.
• Strong organization and follow-through, especially when managing recurring deadlines, evidence requests, and remediation work across multiple teams.
• Sound judgment when handling sensitive information and assessing security risk.
• A collaborative approach and the ability to build productive working relationships with engineering, IT, legal, compliance, and customer-facing teams.

Preferred qualifications

• Experience managing or coordinating a SOC 2 Type II audit cycle.
• Direct experience supporting FedRAMP readiness, assessment, or continuous monitoring activities.
• Direct experience supporting PCI DSS assessments or maintaining PCI-related controls.
• Experience responding to customer security questionnaires, participating in customer security reviews, or supporting vendor due diligence.
• Familiarity with cloud security concepts and AWS environments.
• Familiarity with endpoint detection and response, identity security, security information and event management, vulnerability management, or incident response tools.
• Experience working with security controls across SaaS applications, identity providers, endpoint management, and cloud infrastructure.
• Relevant certifications such as Security+, CISSP, CISA, CISM, or cloud-security credentials are welcome but not required.

How success is measured

• Security alerts and potential incidents are triaged, documented, and escalated appropriately.
• SOC 2 activities and evidence are completed accurately and on schedule, with fewer last-minute audit gaps.
• Control owners understand their responsibilities, and identified gaps have clear owners and remediation plans.
• Customer security questionnaires and meetings receive timely, accurate, and clear responses.
• Security processes and documentation become more consistent, repeatable, and useful to the teams that rely on them.