Information Security Engineer

Highway • Dallas, TX

9d • Onsite

About The Position

Highway is seeking an Information Security Engineer to work across technical security operations, compliance, and customer assurance. The role helps protect Highway’s systems and data, maintain security controls, and manage recurring work for the company’s SOC 2 Type II program.

This position combines hands-on security investigation and ownership of security processes with regular communication across the company and with customers. The engineer investigates alerts and control gaps, coordinates remediation with relevant teams, and clearly explains security issues and Highway’s approach to customers and auditors.

Requirements

• Experience in information security, security operations, compliance, security engineering, or a related role.
• Practical understanding of security monitoring and alert investigation, including documenting findings and determining when to escalate.
• Experience supporting SOC 2, FedRAMP, PCI DSS, or similar security assurance and compliance frameworks.
• Strong written and verbal communication skills, including the ability to explain technical security topics to customers, auditors, and nontechnical colleagues.
• Confidence leading or contributing to customer security conversations without overstating company controls or capabilities.
• Strong organization and follow-through, particularly when managing recurring deadlines, evidence requests, and remediation work across multiple teams.
• Sound judgment when handling sensitive information and assessing security risk.
• Collaborative approach and ability to build productive working relationships with engineering, IT, legal, compliance, and customer-facing teams.

Nice To Haves

• Experience managing or coordinating a SOC 2 Type II audit cycle.
• Direct experience supporting FedRAMP readiness, assessment, or continuous monitoring activities.
• Direct experience supporting PCI DSS assessments or maintaining PCI-related controls.
• Experience responding to customer security questionnaires, participating in customer security reviews, or supporting vendor due diligence.
• Familiarity with cloud security concepts and AWS environments.
• Familiarity with endpoint detection and response, identity security, security information and event management, vulnerability management, or incident response tools.
• Experience working with security controls across SaaS applications, identity providers, endpoint management, and cloud infrastructure.
• Relevant certifications such as Security+, CISSP, CISA, CISM, or cloud-security credentials; welcome but not required.

Responsibilities

• Monitor and investigate security alerts from endpoint, identity, cloud, and other security tools.
• Triage potential security events, gather evidence, document findings, and coordinate response and escalation with internal teams and external security partners as appropriate.
• Maintain and improve incident response procedures, investigation playbooks, and security documentation.
• Identify security weaknesses and control gaps, assess risk, and coordinate practical remediation with engineering, IT, and business stakeholders.
• Support vulnerability management, access reviews, security configuration reviews, and other recurring security activities.
• Help evaluate security implications of changes to systems, infrastructure, applications, and business processes.
• Manage the SOC 2 Type II calendar, including control activities, evidence collection, reviews, auditor requests, and deadlines.
• Coordinate with control owners to ensure controls are understood, performed on schedule, and supported by appropriate evidence.
• Maintain accurate, audit-ready control documentation, policies, procedures, risk records, and evidence.
• Track audit findings, exceptions, remediation plans, and other compliance commitments through completion.
• Support customer and vendor assessments and help align security practices with applicable contractual or compliance requirements.
• Apply knowledge of SOC 2, FedRAMP, and PCI DSS to assess requirements, identify control gaps, and support readiness or ongoing compliance activities as applicable.
• Identify opportunities to make compliance activities more repeatable and efficient without reducing control quality.
• Complete security questionnaires and due-diligence requests with accurate, consistent, appropriately detailed responses.
• Participate in customer meetings to explain Highway’s security program, controls, and practices clearly and confidently.
• Coordinate customer security responses with technical, legal, compliance, and customer-facing teams.
• Maintain approved security responses and supporting materials to keep customer communications current and consistent.
• Communicate security risks, incidents, and recommendations to audiences with different levels of technical knowledge.
• Recommend and implement improvements to security processes, documentation, monitoring, and controls.
• Help develop security awareness and guidance for employees.
• Stay informed about relevant security threats and practices and translate them into actionable recommendations for Highway.
• Contribute to a culture in which security is incorporated into day-to-day decisions and operations.

What This Job Offers

• Job Type: Full-time
• Education Level: No Education Listed