About the role

SpinVFX is Canada’s oldest visual effects studio, with more than thirty years of feature film and episodic work for major studios and streaming platforms. We are a studio of roughly 150 artists and staff in Toronto, and we are rebuilding our infrastructure team from the ground up.

This is a build role. Most of our infrastructure is still provisioned, patched and inventoried by hand, and we are hiring a small team to change that. You own the automation: the code that builds machines, configures them, patches them, and tells us what we have. The Senior Systems Administrator owns the systems once they are built and the Systems Administrator runs day-to-day fleet operations. You own the tooling they both work through, and your success is measured by how much of their week stops being manual.

The foundations exist. Infrastructure is already managed as code in GitLab, with OpenTofu and Ansible run through GitLab CI, a shared CI template repo that every project reuses, and a single Ansible repository that is replacing our legacy AWX deployment. Your job is to finish that work, extend it across the whole fleet, and make it the only way changes happen.

What you will own

- Provisioning and configuration as code. The OpenTofu and Ansible codebase, the GitLab CI pipelines that apply it, and the shared CI templates the rest of engineering builds on. You complete the migration off AWX, bring the vSphere VM lifecycle fully under code, and extend the same model to physical hosts through Foreman and PXE. Changes to infrastructure go through a merge request you can review, or they do not go.
- Fleet patching and OS lifecycle. A patch pipeline that can take a critical advisory to a verified fix across Linux servers, render nodes and workstations within a day, with staged rollout and rollback. You finish the CentOS 7 to Rocky 9 migration, including the bare-metal pools that still carry legacy workloads, and you own the Rocky image and the containerized legacy environments that run on top of it.
- Inventory and configuration state. A current, automatically maintained inventory of every host, VM, container and service we run, reconciled against Snipe-IT and the directory, so that when an advisory lands we know in minutes what is exposed. This is the data the Senior Systems Administrator and the security program depend on.
- Azure landing zone. We are moving a significant share of elastic render and compute into Azure, designed so we are not locked to one provider. You build the landing zone: networking, identity integration, image pipeline, and the OpenTofu modules that stand it up and tear it down. The Senior Systems Administrator operates it once it exists; you make sure it is reproducible from code.
- GitLab and CI platform. Our self-managed GitLab instance, its runners, and the CI conventions the studio depends on. You own upgrades,



runner capacity and security of the platform, and you set the standards for how pipelines are written.
- Containers and runtime. Rootless Podman across the fleet, including the custom subordinate ID tooling we have built, the containerized desktop and agent platforms that run on it, and the images they are built from.
- Observability of the automation. Pipelines that report what they did, where they failed and what drifted, surfaced in our Grafana and Prometheus stack. If a playbook did not run on a host, we should know before the host does something surprising.
- Documentation and knowledge transfer. Every pipeline, module and image has a README that says what it does, how to run it and how to recover from it failing. This is a first-order deliverable, not something that happens when there is time.
- On-call. You take part in the after-hours rotation for the systems you build. The Senior Systems Administrator leads it.

Your first ninety days

- Thirty days: you have read every repo in the infrastructure group, you can run the existing provisioning pipeline end to end, and you have a written map of what is automated, what is half-automated, and what is still done by hand.
- Sixty days: the patch pipeline exists and has been used for a real advisory on at least one host class. AWX is retired or has a dated retirement plan the CTO has agreed to.
- Ninety days: fleet inventory is automatic and trusted, the Rocky 9 migration has a host-by-host plan with dates, and the first Azure landing zone module has been applied and destroyed from CI.

What we need you to bring

- Five or more years in infrastructure, platform or systems engineering, at least two of them owning infrastructure-as-code for a production environment where other engineers depended on your pipelines.
- Deep, hands-on Ansible: roles, collections, inventory design, idempotency, testing. You have built playbooks that patch and configure a fleet, not just run ad hoc tasks.
- OpenTofu or Terraform at the level of writing and reviewing modules, managing state safely, and running plans through CI. Experience with the vSphere provider or an equivalent on-prem provider is strongly preferred.
- GitLab CI (or an equivalent you can map onto it) at the level of designing pipelines, runners and shared templates for a team. Administering a self-managed GitLab instance is a plus.
- Linux systems knowledge deep enough that your automation does the right thing:



Red Hat family packaging and patching, systemd, networking, PXE and image builds. You can debug a host when the playbook fails, not only rerun it.
- Containers in production on Linux hosts, ideally Podman, including image builds and registries.
- Python and Bash to a standard other people can read and reuse.
- Experience with at least one public cloud at the infrastructure level (Azure preferred): networking, identity, compute, deployed through code rather than the portal.
- Experience in visual effects, animation, post-production or another high-throughput media environment is strongly preferred. If you have not worked in one, you should be able to explain why a render farm is not a web fleet.

Nice to have

- Foreman, FOG or similar bare-metal provisioning.
- Render farm schedulers (Tractor, Deadline or similar) and how they interact with the host lifecycle.
- Packer or similar image pipelines for VM and cloud images.
- Rez or another package manager used to deploy software to artist workstations.
- Kubernetes
- Experience building or operating platforms for AI agents or GPU workloads.
- Experience with TPN/MPA assessments or similar content security audits, particularly change control and evidence collection from CI.

How we work

We are a small team rebuilding an old setting, and the people who do well here share a few habits:

- You own problems end to end. When something is yours, production does not have to find someone else to ask.
- You write things down as you learn them, and you teach what you know rather than holding it. Knowledge that only exists in one person’s head is a risk, and we treat it as one.
- You disagree openly, with reasons, and then commit to the decision. You can be wrong without it being a crisis, and you would rather be corrected than stay wrong.
- You build working relationships with artists, producers and the pipeline team, and you treat a support request as a chance to make the studio run better, not as an interruption.
- You would rather automate a task than do it by hand a third time, and you can say when the automation is not worth it yet.

How we hire

Our process is a short screening call, a technical interview with the CTO and IT Manager, a practical exercise where you review and extend a real Ansible role and pipeline from our codebase with us, and a conversation with a pipeline lead about how you work with the rest of the studio. We check references, and we are specific about what we ask. We will tell you where you stand at each step.

To apply, send your resume and a short note on the most manual process you have automated end to end, and what it cost you to get there, to [email protected] with “DevOps Engineer” in the subject line.

Pay: $64,300.00-$151,000.00 per year

Work Location: Hybrid remote in Toronto, ON M5V 3H5

📌 DevOps Engineer (Old Toronto)
🏢 SPIN VFX
📍 Old Toronto