Engineering Manager - FPGA & Hardware - Enforced Security

Opswat•Tampa, FL

About The Position

OPSWAT is hiring an Engineering Manager to own the FPGA discipline for MetaDefender NetWall, its hardware-enforced boundary between networks that must not communicate back. The role builds hardware-enforced protocol termination, one-way transport, and content filtering in FPGA silicon for critical infrastructure, defense, and government deployments. The manager will own FPGA architecture and execution end to end, from silicon and board selection through RTL, verification, timing closure, toolchains, IP licensing, the bring-up lab, and team development. The role partners closely with software engineering, product, certification, QA, manufacturing, and supply chain. Success in the first twelve months means delivering a working hardware datapath, a verified first protocol running in gateware, and an FPGA team that did not previously exist. The position supports an installed NetWall base across energy, manufacturing, defense, government, transportation, and healthcare; extends existing Common Criteria EAL4+ certification and certified optical-isolation hardware; and contributes to a funded multi-year program targeting 100 Gbps and NCDSMO Raise the Bar. The role has budget and hiring authority to build the FPGA team from the first hire, outside the standard requisition process.

Requirements

At least five years of FPGA development experience, including production RTL in a shipping product and experience leading or managing FPGA engineers.
Deep SystemVerilog or VHDL expertise, with ownership of architecture, verification, and timing closure on large designs.
High-speed interface experience, including multi-gigabit transceivers, Ethernet MAC and PCS, PCIe endpoints, and DMA.
Demonstrated experience implementing protocols in hardware, such as parsing, state machines, or offload; datapath or signal-processing experience alone is not sufficient.
Verification experience with UVM, constrained-random and coverage-driven methodology, and exposure to formal property verification.
Fluency with at least one major FPGA toolchain: AMD Vivado or Altera Quartus Prime Pro; ability to establish build and regression infrastructure from scratch.
Demonstrated AI-native working style, with concrete examples of using AI and agentic tools to design, verify, analyze, and document; this is an expectation of the role.
Technical depth to discuss Linux drivers, networking, security architecture, and system performance on either side of the hardware boundary.
Must be a U.S. person (U.S. citizen or lawful permanent resident) and eligible for a security clearance.
Bias toward action and ability to make sound decisions without perfect information while keeping the team moving.
Professional fluency in English.

Nice To Haves

Experience with cross-domain solutions, data diodes, guards, or other high-assurance security hardware.
Common Criteria, FIPS 140-3, or NCDSMO Raise the Bar experience as a technical contributor or owner.
Active U.S. security clearance.
Formal verification of security properties or design assurance in avionics, rail, or nuclear instrumentation.
Experience with 100 Gbps networking, TCP offload, or TLS acceleration in hardware.
Experience with both AMD and Altera toolchains.
Experience in critical infrastructure, OT, or industrial environments.

Responsibilities

Own the FPGA discipline for the NetWall line, including RTL architecture, verification strategy, timing closure, coding standards, IP selection, build and regression infrastructure, and hiring and development of engineers.
Select FPGA silicon and commercial off-the-shelf boards based on sustained line rate, fabric and transceiver headroom, PCIe generation, optical cage compatibility, lead time, and license cost; manage resulting vendor relationships.
Build the one-way datapath in gateware, including framing, link supervision, no back-channel behavior, fail-closed handling on every error path, and re-assembly on the receiving side.
Move protocol termination into hardware, including TCP state machines and, in time, TLS termination and re-origination, with termination on the sending side and re-origination on the receiving side without an acknowledgement path across the boundary.
Own verification as a first-class deliverable, including UVM environments, constrained-random regression, coverage closure, and formal proof of certification-dependent properties such as always-invoked, non-bypassable, and fail-closed behavior.
Deliver design independence for certification through two filter implementations on two silicon lineages, two toolchains, and two teams using a shared implementation-neutral specification; analyze and demonstrate that no common-mode defect can exist.
Own the hardware-software interface with software engineering, including PCIe endpoints, DMA engines, driver contracts, and decisions about what runs in gateware versus on the host.
Partner with certification throughout design development on evidence, including design documentation, requirement traceability, and authorship provenance for Common Criteria or NCDSMO assessments.
Use modern AI and agentic tools with the team to explore architectures, generate and review testbenches, analyze waveforms and regression output, and accelerate verification while maintaining provenance discipline for materials entering the certified boundary.
Own timing, area, power, and cost, including timing closure on large designs at line rate and understanding the device, license, and board costs driven by architectural choices.
Own the bring-up lab, including boards, optics, traffic generation, protocol analysis, and test capabilities.
Build and lead the FPGA team by recruiting senior FPGA engineers, setting the technical bar, and growing the discipline from the first hire to two independent implementation teams.