A build role spanning three intertwined domains: design infrastructure (the CAD, compute, and EDA environment our silicon depends on), corporate IT (identity, endpoints, connectivity, and SaaS for a five-site global company), and the security program that spans both. There is no internal IT department today — the environment is MSP-supported and the architecture is yours to define. You will operate an EDA environment representing $5–10M in annual spend, a three-zone infrastructure model (Corporate, Design/CAD, Lab/OT) governed by export-control classification. CAD and IT carry equal weight, and security is required within both: our technology is export-controlled, our customers are the most security-demanding infrastructure buyers on earth, and there is no CISO above this role. And we expect aggression on AI: this role drives aggressive AI use and adoption across the company rather than waiting to be asked.

What You Will Own

• Design infrastructure & CAD. Design compute (batch scheduling, cloud burst), EDA licensing operations — license servers, utilization telemetry, denial-rate and cost-per-seat reporting; contract and IP negotiation stays with company leadership — the access-controlled PDK enclave, design data management, and storage engineered for EDA workloads.
• Corporate IT. Identity as a system (single IdP, SAML/SCIM, conditional access, hardware-key MFA), the global Windows/macOS/Linux endpoint fleet under unified MDM, WAN across five sites, the SaaS portfolio and its spend, and the MSP managed against an SLA you write.
• Security across both zones. EDR on every host including Linux design machines; the outsourced security stack — SOC/MDR partner and SIEM — where you own the outcome and they own the night shift; phishing-resistant MFA; incident response end to end across time zones; segmentation between zones; customer security reviews answered unaided.
• Export-controlled environments. Operate the design zone under our Technology Control Plan: deemed-export access controls with per-nationality entitlements, logging, quarterly access reviews, and audit-ready evidence.
• AI adoption. Drive aggressive AI use across engineering and corporate workflows — pick the tools, build the guardrails that make AI safe inside an export-controlled environment, and lead by using it yourself. The job is to make yes safe, not to say no.

First-Year Outcomes

Day 90: asset and access inventory across five sites; EDR on every Windows and Linux host; hardware-key MFA on privileged accounts; MSP SLA rewritten. 
Day 180: outsourced SOC/MDR live with SIEM ingesting both zones; identity on a single IdP; PDK enclave access model live; first hire started.
Day 365: incident response tabletop run; a hyperscaler security review passed unaided; license telemetry feeding leadership’s renewal decisions.

Must Have

• CAD: 10+ years in semiconductor design infrastructure at a fabless or IDM; ran design compute, EDA licensing operations at $5–10M scale, and PDK/design-data management; supported tape-outs under deadline.
• IT: ran identity as a system (SAML/SCIM, conditional access, hardware keys); managed a multi-country Windows/macOS/Linux fleet; managed an MSP against an SLA they wrote; completed customer security questionnaires unaided.
• Security: operated EDR across mixed Windows/Linux fleets; personally owned a real incident end to end; ran security through outsourced SOC/MDR and SIEM vendors and owned the detection outcome anyway; built access-controlled environments for sensitive IP.
• Across all of it: built from near-zero at least once; an aggressive, hands-on adopter of AI in their own work; effective across Asia time zones with a small team plus vendors; translates technical risk into executive decisions; a U.S. person or eligible for required export authorizations.

What This Role Is Not

Not a caretaker role, not a single-discipline role, not the EDA contract owner, and not paper security — this role runs the controls, it does not just document them.

Preferred: TCP/deemed-export operating experience; Defender, Intune, and Entra conditional access in production; FreeIPA in Linux design environments; ISO 27001, SOC 2, or NIST 800-171 exposure.