Director of CAD & IT

Cspeed IO is a stealth start up backed by Sutter Hill Ventures and Atreides Capital - headquartered in Palo Alto, CA. Our executive team has a demonstrated track record of building and scaling category-defining semiconductor and infrastructure businesses at companies like Broadcom, Lumentum, Tesla, Apple, Samsung, Intel, and VMware. Cspeed IO is developing next-generation optical semiconductor solutions for the AI infrastructure market, focused on enabling true “scale-up” architectures. Our mission is to replace traditional copper interconnects with advanced fiber-optic technologies that overcome the limitations of existing optics solutions and architectures. A build role spanning three intertwined domains: design infrastructure (the CAD, compute, and EDA environment our silicon depends on), corporate IT (identity, endpoints, connectivity, and SaaS for a five-site global company), and the security program that spans both. There is no internal IT department today — the environment is MSP-supported and the architecture is yours to define. You will operate an EDA environment representing $5–10M in annual spend, a three-zone infrastructure model (Corporate, Design/CAD, Lab/OT) governed by export-control classification. CAD and IT carry equal weight, and security is required within both: our technology is export-controlled, our customers are the most security-demanding infrastructure buyers on earth, and there is no CISO above this role. And we expect aggression on AI: this role drives aggressive AI use and adoption across the company rather than waiting to be asked. What You Will Own Design infrastructure & CAD. Design compute (batch scheduling, cloud burst), EDA licensing operations — license servers, utilization telemetry, denial-rate and cost-per-seat reporting; contract and IP negotiation stays with company leadership — the access-controlled PDK enclave, design data management, and storage engineered for EDA workloads. Corporate IT. Identity as a system (single IdP, SAML/SCIM, conditional access, hardware-key MFA), the global Windows/macOS/Linux endpoint fleet under unified MDM, WAN across five sites, the SaaS portfolio and its spend, and the MSP managed against an SLA you write. Security across both zones. EDR on every host including Linux design machines; the outsourced security stack — SOC/MDR partner and SIEM — where you own the outcome and they own the night shift; phishing-resistant MFA; incident response end to end across time zones; segmentation between zones; customer security reviews answered unaided. Export-controlled environments. Operate the design zone under our Technology Control Plan: deemed-export access controls with per-nationality entitlements, logging, quarterly access reviews, and audit-ready evidence. AI adoption. Drive aggressive AI use across engineering and corporate workflows — pick the tools, build the guardrails that make AI safe inside an export-controlled environment, and lead by using it yourself. The job is to make yes safe, not to say no. First-Year Outcomes Day 90: asset and access inventory across five sites; EDR on every Windows and Linux host; hardware-key MFA on privileged accounts; MSP SLA rewritten. Day 180: outsourced SOC/MDR live with SIEM ingesting both zones; identity on a single IdP; PDK enclave access model live; first hire started. Day 365: incident response tabletop run; a hyperscaler security review passed unaided; license telemetry feeding leadership’s renewal decisions. Must Have CAD: 10+ years in semiconductor design infrastructure at a fabless or IDM; ran design compute, EDA licensing operations at $5–10M scale, and PDK/design-data management; supported tape-outs under deadline. IT: ran identity as a system (SAML/SCIM, conditional access, hardware keys); managed a multi-country Windows/macOS/Linux fleet; managed an MSP against an SLA they wrote; completed customer security questionnaires unaided. Security: operated EDR across mixed Windows/Linux fleets; personally owned a real incident end to end; ran security through outsourced SOC/MDR and SIEM vendors and owned the detection outcome anyway; built access-controlled environments for sensitive IP. Across all of it: built from near-zero at least once; an aggressive, hands-on adopter of AI in their own work; effective across Asia time zones with a small team plus vendors; translates technical risk into executive decisions; a U.S. person or eligible for required export authorizations. What This Role Is Not Not a caretaker role, not a single-discipline role, not the EDA contract owner, and not paper security — this role runs the controls, it does not just document them. Preferred: TCP/deemed-export operating experience; Defender, Intune, and Entra conditional access in production; FreeIPA in Linux design environments; ISO 27001, SOC 2, or NIST 800-171 exposure. #J-18808-Ljbffr CScale