Senior Systems Administrator

SPINVFX

Location: Toronto, Ontario (hybrid). Reports to: Chief Technology Officer. Type: Full time, permanent.

SpinVFX is Canada's oldest visual effects studio, with more than thirty years of feature film and episodic work for major studios and streaming platforms. We are a studio of roughly 150 artists and staff in Toronto, and we are rebuilding our infrastructure team from the ground up.

This is a hands-on senior engineering role, not a maintenance role. You will take ownership of the systems that production runs on: storage, virtualization, identity, networking in partnership with our IT Manager, and the operational side of our move to Azure for elastic compute. Much of this environment is older and more manual than it should be. Your mandate is to understand it, document it, stabilize it, and modernize it in a planned way, working alongside a DevOps engineer who owns provisioning and configuration tooling and a Systems Administrator who carries day-to-day fleet operations.

You will be the technical escalation point for the team and the person production comes to when something is wrong and no one else knows why.

• Storage. Administration, performance, capacity planning and data lifecycle for our Qumulo and Isilon clusters, serving a mixed Linux, Windows and macOS floor over NFS and SMB. You own the storage path from artist workstation to render node and are expected to diagnose performance problems at the file system and network level.
• Monitoring, backup and disaster recovery. Deploy and maintain monitoring that tells us about problems before artists do, and own backup for production data and core services. You implement and test the studio's disaster recovery plan against the recovery objectives set by the CTO and IT Manager, and you run the recovery exercise that proves it.
• Virtualization. Our VMware vSphere environment and the services that run on it. You will work with the DevOps engineer to move the VM lifecycle from manual builds to code-driven provisioning (OpenTofu and Ansible through GitLab CI, which is how our infrastructure is already managed), and you own what runs once it is built. Changes to the systems you own go through that code, not around it.
• Identity and directory services. Active Directory, Microsoft Entra ID, Conditional Access and MFA, Google Workspace, and the sync between them. You own the health of the directory, DNS and DHCP, and the identity path for cloud workloads as they come online.
• Cloud operations. We are moving a significant share of our elastic render and compute capacity into Azure, designed so that we are not locked to a single provider. The DevOps engineer builds the landing zone; you own operating it: image lifecycle, the storage path to cloud nodes, dispatch from the render farm, cost visibility, and keeping the security posture consistent with our client obligations.
• Render farm and workstation fleet health. The Linux render farm (Pixar Tractor), the HP Anyware (PCoIP) remote access layer (you own the PCoIP hosts, agents, connection broker and licensing, and partner with the Pipeline team on the containerized desktops that run on top of it), and the workstation fleet, which runs Rocky Linux 9 with legacy workloads in containers. The Systems Administrator runs the license servers, builds and patching; you set the standards and handle what they escalate.
• Security operations. We run an air-gapped production network and hold content security obligations to major clients. You will implement and maintain controls on the systems you own, support client audits, and work with the IT Manager on firewall, egress and ingest policy.
• Vendor management. You hold the technical relationship with the vendors behind the systems you own (storage, virtualization, remote access, Microsoft): support cases, escalations, health checks and roadmap conversations. Commercial terms, renewals and purchasing sit with studio operations; you make sure they have what they need to act on time.
• Documentation and knowledge transfer. Every system you take over gets a runbook, a diagram and a recovery procedure, written in our documentation system. This is a first-order deliverable, not something that happens when there is time.
• On-call. You lead the after-hours on-call rotation and are the escalation point for the people in it.

• Thirty days: you have been through every production system with the IT Manager and can draw the storage, network, identity and virtualization topology from memory. You have found the things that are held together by habit and written them down.
• Sixty days: you own storage, vSphere and identity outright. You have a prioritized list of what to fix first and why, and you have fixed the most dangerous item on it.
• Ninety days: runbooks exist for everything you own, backup has been tested and the first disaster recovery exercise is scheduled, and you have a written plan for the operational side of the Azure move that the CTO and IT Manager have agreed to.

• Seven or more years administering Linux (Red Hat family) and Windows Server in a production environment, at least three of them in a senior or lead capacity where you were the final technical escalation.
• Hands-on ownership of enterprise NAS in production: Qumulo, Isilon or equivalent, including performance troubleshooting, not just provisioning shares.
• VMware vSphere administration at the level of designing clusters and recovering from failures, not just creating VMs.
• Active Directory and Entra ID administration, including hybrid identity, Conditional Access and MFA. Google Workspace administration.
• Networking fundamentals you can apply under pressure: VLANs, routing, DNS, DHCP, firewall rule logic, and high-bandwidth storage networking. You should be able to work through a packet capture.
• Scripting in Python, Bash and PowerShell to a standard that other people can read and reuse. Working fluency with Git, Ansible and OpenTofu or Terraform: you can read a plan, review a merge request, write or change a module for the systems you own, and work through a CI pipeline rather than around it. You do not have to have built the pipeline; the DevOps engineer owns that. You do have to live in it.
• Experience running or supporting monitoring, backup and disaster recovery for a production environment.
• Experience in visual effects, animation, post-production or another high-throughput media environment is strongly preferred. If you have not worked in one, you should be able to explain why the storage and network problems in one are different from a corporate environment.
• Able to lift and rack equipment up to 23 kg.

• Azure (or equivalent): compute, networking, identity integration and cost management, especially when deployed through OpenTofu or Terraform.
• Containers in production, particularly Podman or Docker on Linux hosts.
• Render farm management (Tractor, Deadline or similar) and DCC licensing (Autodesk, SideFX, Foundry).
• HP Anyware or other PCoIP remote access deployments.
• FortiGate or equivalent enterprise firewalls.
• Experience with TPN/MPA assessments or similar content security audits.

We are a small team rebuilding an old environment, and the people who do well here share a few habits:

• You own problems end to end. When something is yours, production does not have to find someone else to ask.
• You write things down as you learn them, and you teach what you know rather than holding it. Knowledge that only exists in one person's head is a risk, and we treat it as one.
• You disagree openly, with reasons, and then commit to the decision. You can be wrong without it being a crisis, and you would rather be corrected than stay wrong.
• You build working relationships with artists, producers and the pipeline team, and you treat a support request as a chance to make the studio run better, not as an interruption.
• You would rather automate a task than do it by hand a third time, and you can say when the automation is not worth it yet.

Our process is a short screening call, a technical interview with the CTO and IT Manager, a practical exercise where you work through a realistic storage or systems problem in a live environment with us, and a conversation with a production lead about how you work with the rest of the studio. We check references, and we are specific about what we ask. We will tell you where you stand at each step.

To apply, send your resume and a short note on the most complex infrastructure problem you have owned end to end to [email protected] with "Senior Systems Administrator" in the subject line.