Ruan du Toit — Curriculum vitae

Ruan du Toit

Ruan du Toit

Senior DevOps & Platform Engineer

hello@ruandutoit.onlineEly, CambridgeshireLinkedIn ↗

UK Indefinite Leave to Remain · No sponsorship required

Production infrastructure. Practical AI.

I lead DevOps at UNEP-WCMC, looking after the infrastructure behind UN Biodiversity Lab, Protected Planet and Species+. Before that, I was Staff Engineer and Platform Team Manager at Agile Analog.

13 years running production systems across an ISP, e-commerce and UN public data platforms. I combine hands-on engineering in Terraform, Ansible, Linux, Go and Python with team leadership, incident response and a growing focus on AI infrastructure.

Almost 60cloud hosts across AWS, Azure & Linode
8+ projectsusing my reusable deployment workflows
15+ incidentsproduction & security responses led

I build tools that make operations easier: self-service VMs, fleet automation and AI agents with human approval. I have worked with LLMs since 2023, use coding agents daily and test their output before it ships.

Download CV · PDF ↓Word ↓Discuss a role ↗September 2026

Work experience

Senior DevOps Engineer and Team Lead
UNEP-WCMC, Cambridge
Jan 2024 – present

Lead a DevOps team of two at the UN Environment Programme's biodiversity centre, owning almost 60 cloud hosts across AWS, Azure and Linode, a 5-node Proxmox cluster, and the platforms behind UN Biodiversity Lab (UNBL), Protected Planet and Species+.

  • Re-platformed the public GIS service from Windows Server to Ubuntu on AWS, taking ArcGIS Enterprise and PostgreSQL up several major versions while keeping every public URL working.
  • Rebuilt UNBL, the UN's spatial-data platform for national biodiversity planning, on Azure with Terraform and Bicep: staging and production, auto-scaling, MongoDB backup and restore, and cost controls.
  • Mentored a junior engineer, ran the estate alone between hires and onboarded a new engineer. Created the team's hiring test, one-command developer setup and auditable zero-trust access (Teleport, NetBird).
  • Introduced fleet-wide Ansible automation with AWX on managed Kubernetes (Linode LKE) and Vault-backed secrets; the first complete server inventory uncovered servers nobody was tracking.
More delivery, security & AI work
  • Stood up a VPC-isolated Species+ stack alongside live production with no downtime, and a national environmental information system on Azure, both in Terraform.
  • Wrote the org-wide GitHub Actions library for Kamal 2 deployments, used by 8+ production projects and hardened against CI injection, running on two redundant sets of four self-hosted runners on Kubernetes with custom Ruby and Kamal images.
  • Upgraded the Proxmox cluster and self-hosted GitLab (with PostgreSQL) across major versions with no data loss.
  • Developed an in-house operations console (Python and Django, later rewritten in Go and Vue) covering fleet logs, web analytics, scheduled Ansible runs, backups and cloud billing, with Slack integration.
  • Delivered self-service VMs on Proxmox: staff sign in with Active Directory and get virtual machines on demand, with Slack integration.
  • Led the response to 15+ production and security incidents (including a botnet attack), introduced written incident reports, and rebuilt monitoring with Zabbix (replacing Nagios), Prometheus, Grafana and Graylog.
  • Cut idle AWS spend, led a UK-GDPR data-disposal audit of a legacy account holding ~444 TB, and wrote a read-only audit tool covering five AWS accounts.
  • Set up an on-premises LLM platform on pooled GPUs and a RAG prototype over UNBL's dataset catalogue, keeping all data on UNEP-WCMC hardware.
  • Deployed OpenUniverse, my own AI operations platform, with the organisation's permission: its agents run on GLM-4.7 and investigate ops tickets and incidents.
Staff Engineer (DevSecOps) and Platform Team Manager
Agile Analog, Cambridge
Sep 2021 – Jun 2023

Joined as Platform Engineer in 2021, promoted to Senior DevSecOps Engineer in 2022 and to Staff Engineer and Platform Team Manager in 2023. Left in June 2023 when most of the Platform team was made redundant.

  • Line-managed the Platform team and ran its planning, Jira projects and internal helpdesk.
  • Built isolated AWS project environments with Terraform, VPC peering and FortiGate access, monitored through Security Hub and CloudTrail alerts.
  • Ran configuration and secrets management with Puppet, Foreman and HashiCorp Vault, with Zabbix monitoring.
  • Cut idle EC2 spend with a custom AMI that supported hibernation, and introduced Kasm Workspaces for high-security work.
DevOps Engineer
RSAWEB, Cape Town
Sep 2017 – Sep 2021

Cloud Engineer, then DevOps Engineer from 2018, in the Core Network team of an ISP serving hundreds of thousands of customers.

  • Ran core network services (FreeRADIUS, PowerDNS with DNSSEC, Sandvine PacketLogic) and penetration-tested internal core services.
  • Automated Linux server builds with Chef and Terraform across AWS and VMware, built CI/CD in Jenkins and GitHub Actions, and ran a shared-hosting Docker cluster.
  • Operated MySQL clusters behind ProxySQL and Percona, plus MongoDB, with Zabbix and TICK-stack monitoring.
DevOps Engineer
InventCommerce, Cape Town
Nov 2013 – Sep 2017
  • Ran hosting infrastructure and architecture planning for e-commerce clients including Pearson, Danone and Edcon.
  • Ran Jenkins CI, advised clients on Docker, and load-tested client platforms with JMeter.

Tools I use to deliver

Production experience across infrastructure, delivery, security and AI.

DevOps
DevOps100%
CI/CD80%
Cloud
Amazon Web Services80%
Infrastructure
Terraform80%
Systems
Linux100%
Programming
Python60%
Scripting
Bash Scripting60%
Database
MySQL60%
Containers
Docker60%
Orchestration
Kubernetes80%
Configuration Management
Ansible80%
Web Servers
NGINX80%
Monitoring
Zabbix80%
Version Control
GitHub80%
Gitlab80%
100%
Systems
90%
DevOps
80%
Cloud
80%
Infrastructure
80%
Orchestration
80%
Configuration Management

Full toolkit · September 2026

Infrastructure as code

Terraform, Ansible, AWX, Bicep, cloud-init, Puppet, Chef

Containers and virtualisation

Docker, Kubernetes (Linode LKE, Kustomize, cert-manager, kubectl), Proxmox VE, VMware

CI/CD

GitHub Actions (reusable workflows, self-hosted runners), GitLab CI, Kamal, Jenkins

Cloud

AWS (EC2, S3, VPC, IAM, RDS, Route 53, CloudTrail, Security Hub), Azure, Linode

AI engineering

LLM agents, human-in-the-loop guardrails, MCP, multi-agent workflows, Claude Code, Anthropic and OpenAI APIs, RAG, self-hosted LLM inference (llama.cpp on GPUs), prompt caching

Observability

Zabbix, Prometheus, Grafana, Graylog

Security and identity

HashiCorp Vault, Teleport, NetBird, Active Directory / LDAP, SAST (gosec), UK-GDPR

Networking and edge

Cloudflare (DNS, Tunnels, Workers, WAF, API), NGINX, Traefik, WireGuard, FreeRADIUS, PowerDNS

Languages

Go, Python, Bash, SQL

Data

PostgreSQL, PostGIS, MySQL, MongoDB

AI infrastructure & agent engineering

Building with LLMs since 2023. My focus is useful operational tools, private inference and human control over infrastructure actions.

At UNEP-WCMC
Self-hosted inference

Set up an on-premises LLM platform on pooled GPUs and a RAG prototype over UNBL’s dataset catalogue, keeping the data on UNEP-WCMC hardware.

Proxmox → GPUs → llama.cpp → Internal inference
Personal project · Private alpha
OpenUniverse

AI agents investigate incidents and tickets through SSH, Ansible and OpenTofu. Deployed at UNEP-WCMC with the organisation’s permission.

  • 82 MCP infrastructure tools with logged calls and redacted secrets.
  • Allow/ask/deny guardrails and human approval in Slack.
  • Go and Vue 3, with 1,000+ automated tests.
  • Prompt caching reduced input-token cost by approximately 90%.
Explore OpenUniverse →
Personal project · Invite-only alpha
Hostirr

A compute marketplace for idle machines, with gVisor and Kata sandboxes. Its LLM deployment pipeline reads a repository, writes its Dockerfile and repairs failed builds.

Explore Hostirr →

For my personal projects, I set the design and test every change; AI coding agents write most of the code.

Education & training

Cisco Certified Network Associate

CCNA · 2005 · Lapsed

IT Engineering

CTI, Cape Town · 2003

English & Afrikaans · Driving licence

Plain-text CV (Markdown)