Information Security Engineer

Highway is the fastest-growing freight tech provider in North America. We serve the largest freight brokers in the industry, solving one of their biggest pain points: who is really hauling their freight. We answer the question of Carrier Identity, protecting brokers' networks, preventing fraud and increasing transparency. Serving and protecting our customers is our top priority, and we are proud that our best marketing is our customer referrals and testimonials.

FLSA Status: Exempt

Location: Dallas, TX (This is an onsite position)

Reports to: Chief Information Officer

Status: Full-time

Highway is looking for an Information Security Engineer who can work comfortably across technical security operations, compliance, and customer assurance. This person will help protect Highway's systems and data, maintain our security controls, and manage the recurring work required to support our SOC 2 Type II program.

The role combines hands-on investigation and security-process ownership with regular communication across the company and with customers. The right person can examine a security alert or control gap, work with the relevant teams to address it, and explain the issue and our approach clearly to a customer or auditor.

• Monitor and investigate security alerts from our endpoint, identity, cloud, and other security tools.
• Triage potential security events, gather relevant evidence, document findings, and coordinate response and escalation with internal teams and external security partners as appropriate.
• Help maintain and improve incident response procedures, investigation playbooks, and security documentation.
• Identify security weaknesses and control gaps, assess their risk, and coordinate practical remediation with engineering, IT, and business stakeholders.
• Support vulnerability management, access reviews, security configuration reviews, and other recurring security activities.
• Help evaluate security implications of changes to systems, infrastructure, applications, and business processes.

• Manage the SOC 2 Type II calendar, including control activities, evidence collection, reviews, auditor requests, and key deadlines.
• Coordinate with control owners across the company to ensure controls are understood, performed on schedule, and supported by appropriate evidence.
• Maintain accurate and audit-ready control documentation, policies, procedures, risk records, and evidence.
• Track audit findings, exceptions, remediation plans, and other compliance commitments through completion.
• Support customer and vendor assessments and help maintain alignment between security practices and applicable contractual or compliance requirements.
• Apply knowledge of security and compliance frameworks—including SOC 2, FedRAMP, and PCI DSS—to assess requirements, identify control gaps, and support readiness or ongoing compliance activities as applicable.
• Identify opportunities to make compliance activities more repeatable and efficient without reducing the quality of the control environment.

• Complete security questionnaires and due-diligence requests with accurate, consistent, and appropriately detailed responses.
• Participate in customer meetings to explain Highway's security program, controls, and practices in clear, confident language.
• Coordinate responses to customer security questions with technical, legal, compliance, and customer-facing teams.
• Help maintain approved security responses and supporting materials so customer communications remain current and consistent.
• Communicate security risks, incidents, and recommendations to audiences with different levels of technical knowledge.

• Recommend and implement improvements to security processes, documentation, monitoring, and controls.
• Help develop security awareness and guidance for employees.
• Stay informed about relevant security threats and practices, and translate them into actionable recommendations for Highway.
• Contribute to a culture in which security is incorporated into day-to-day decisions and operations.

• Experience in information security, security operations, compliance, security engineering, or a related role.
• A practical understanding of security monitoring and alert investigation, including how to document findings and determine when to scale.
• Experience supporting SOC 2, FedRAMP, PCI DSS, or similar security assurance and…