Engineering Manager - FPGA & Hardware - Enforced Security

OPSWAT•Tampa, FL

About The Position

OPSWAT is hiring an Engineering Manager to own the FPGA discipline for MetaDefender NetWall, a hardware- and software-based security boundary used across critical infrastructure, defense, and government. The role is responsible for building the hardware layer that enforces protocol termination, one-way transport, and content filtering in FPGA silicon. It spans silicon and board selection, RTL architecture, verification strategy, timing closure, toolchains, IP licensing, the bring-up lab, and building and leading the FPGA team. The manager partners closely with software engineering, product, certification, QA, manufacturing, and supply chain. The role will build a hardware datapath and deliver a verified first protocol in gateware, while creating an FPGA team from its first hire. The program is funded to develop the product line toward 100 Gbps and NCDSMO Raise the Bar. The position has budget and hiring authority to build the team outside the standard requisition process. The existing product has an installed base across several sectors, existing Common Criteria EAL4+ certification, and certified optical isolation hardware. The broader R&D organization has approximately 50 engineers. The position requires substantial hands-on FPGA engineering experience and experience leading or managing FPGA engineers. The successful candidate will have production RTL experience in a shipping product, deep ownership of architecture, verification, and timing closure, and demonstrated hardware protocol implementation experience. They must be a US citizen or lawful permanent resident and eligible for a security clearance. The role also expects an AI-native working style, with practical use of AI and agentic tools in design, verification, analysis, and documentation, while maintaining provenance discipline for certified work.

Requirements

Five or more years of FPGA development experience, including production RTL in a shipping product and experience leading or managing FPGA engineers.
Deep SystemVerilog or VHDL experience, with ownership of architecture, verification, and timing closure on large designs rather than module-level contribution alone.
High-speed interface experience, including multi-gigabit transceivers, Ethernet MAC and PCS, PCIe endpoints, and DMA.
Demonstrated protocol implementation in hardware, such as parsing, state machines, or offload.
Experience with UVM, constrained-random and coverage-driven verification methodology, and exposure to formal property verification.
Fluency in at least one major toolchain: AMD Vivado or Altera Quartus Prime Pro; ability to establish build and regression infrastructure from scratch.
Demonstrated AI-native working style, with concrete examples of using AI and agentic tools to design, verify, analyze, and document.
Technical depth to discuss Linux drivers, networking, security architecture, and system performance on either side of the hardware boundary.
US citizen or lawful permanent resident and eligible for a security clearance.
Bias toward action and ability to make sound decisions without perfect information while keeping the team moving.
Professional fluency in English.

Nice To Haves

Experience with cross-domain solutions, data diodes, guards, or other high-assurance security hardware.
Common Criteria, FIPS 140-3, or NCDSMO Raise the Bar experience as a technical contributor or owner.
Active US security clearance.
Formal verification of security properties, or design assurance experience in avionics, rail, or nuclear instrumentation.
Experience with 100 Gbps networking, TCP offload, or TLS acceleration in hardware.
Experience across both AMD and Altera toolchains.
Experience in critical infrastructure, operational technology, or industrial environments.

Responsibilities

Own the FPGA discipline for the NetWall product line, including RTL architecture, verification strategy, timing closure, coding standards, IP selection, build and regression infrastructure, and hiring and developing engineers.
Evaluate and select FPGA silicon and commercial off-the-shelf boards based on sustained line rate, fabric and transceiver headroom, PCIe generation, optical cage compatibility, lead time, and licensing cost; manage the resulting vendor relationships.
Build the one-way datapath in gateware, including framing, link supervision, prevention of a back-channel, fail-closed behavior on error paths, and reassembly on the receiving side.
Move protocol termination into hardware, including TCP state machines and, over time, TLS termination and re-origination without an acknowledgement path across the boundary.
Own verification as a first-class deliverable, including UVM environments, constrained-random regression, coverage closure, and formal proof of properties required for certification.
Deliver design independence for certification through two filter implementations on two silicon lineages, two toolchains, and two teams, using a shared implementation-neutral specification and analysis demonstrating the absence of common-mode defects.
Own the hardware and software interface with software engineering, including PCIe endpoints, DMA engines, driver contracts, and decisions about which functionality runs in gateware versus on the host.
Partner with certification throughout design and provide design documentation, requirement traceability, and authorship provenance for Common Criteria or NCDSMO assessments.
Use modern AI and agentic tools with the team to explore architectures, generate and review testbenches, analyze waveforms and regression output, and accelerate verification while maintaining provenance discipline for work entering the certified boundary.
Manage timing, area, power, and cost, including closing timing on large designs at line rate and understanding the device, license, and board costs resulting from architecture choices.
Own the bring-up lab, including boards, optics, traffic generation, protocol analysis, and test capabilities.
Recruit senior FPGA engineers, set the technical bar, and grow the discipline from its first hire to two independent implementation teams.