Engineering Manager - FPGA & Hardware - Enforced Security

OPSWAT , a global leader in IT, OT , and ICS critical infrastructure cybersecurity, delivers an end-to-end platform that gives public and private sector organizations and enterprises the critical advantage needed to protect their complex networks, secure their devices, and ensure compliance. Over the last 20 years our commitment to innovative technology has earned the trust of more than 1,700 organizations, governments, and institutions globally, solidifying our role in protecting the world’s critical infrastructure and securing our way of life. Role Summary MetaDefender NetWall is OPSWAT's hardware-enforced boundary between networks that must never be able to talk back — a combined hardware and software product deployed across critical infrastructure, defense, and government. This role builds the layer that makes that guarantee physical rather than declared: protocol termination, one-way transport, and content filtering enforced in FPGA (Field-Programmable Gate Array) silicon, at rates no general-purpose processor can sustain. The Engineering Manager owns the FPGA discipline end to end — silicon and board selection, RTL (Register-Transfer Level) architecture, verification strategy, timing closure, toolchains, IP (Intellectual Property) licensing, the bring-up lab, and the team that does the work — and partners daily with software engineering, product, certification, QA (Quality Assurance), manufacturing, and supply chain. Success in the first twelve months means a working hardware datapath, a verified first protocol running in gateware, and an FPGA team that did not exist before — not the volume of RTL written. What Comes With the Role An installed base across energy, manufacturing, defense, government, transportation, and healthcare, already running on the NetWall unidirectional and bilateral security gateways An existing Common Criteria EAL4+ certification to extend rather than earn, and certified optical isolation hardware already in the product An R&D (Research and Development) organization of approximately 50 engineers, and the MetaDefender® platform — Multiscanning, Deep CDR™ Technology, Proactive DLP™ Technology, and policy enforcement — to build on rather than replicate A funded multi-year program to take the line to 100 Gbps and to NCDSMO (National Cross Domain Strategy and Management Office) Raise the Bar Budget and hiring authority to build the FPGA team from the first engineer, outside the standard requisition process Key Responsibilities Own the FPGA discipline for the NetWall line — RTL architecture, verification strategy, timing closure, coding standards, IP selection, build and regression infrastructure, and the hiring and development of the engineers who do it Select the silicon and the boards — evaluate FPGA families and COTS (Commercial Off-The-Shelf) cards against sustained line rate, fabric and transceiver headroom, PCIe (Peripheral Component Interconnect Express) generation, optical cage compatibility, lead time, and licence cost — and own the vendor relationships that follow Build the one-way datapath in gateware — framing, link supervision, no back-channel, fail-closed behaviour on every error path, and re-assembly on the receiving side Move protocol termination into hardware — TCP (Transmission Control Protocol) state machines, and in time TLS (Transport Layer Security) termination and re-origination — terminating on the sending side and re-originating on the receiving side with no acknowledgement path across the boundary Own verification as a first-class deliverable — UVM (Universal Verification Methodology) environments, constrained-random regression, coverage closure, and formal proof of the properties certification depends on: always invoked, non-bypassable, fail-closed Deliver the design independence that certification requires — two filter implementations on two silicon lineages, two toolchains, two teams, one shared implementation-neutral specification, and the analysis that demonstrates no common-mode defect can exist Own the hardware and software interface with software engineering — PCIe endpoints, DMA (Direct Memory Access) engines, driver contracts, and the boundary decisions that determine what runs in gateware and what runs on the host Partner with certification on evidence as the design is built, not afterwards — design documentation, requirement traceability, and the authorship provenance a Common Criteria or NCDSMO assessment will ask for years after the code was written <span data-ccp-props