Co-Managed Security Operations Centre Service

The procuring agency in Fiji is seeking a vendor to deliver a co-managed Security Operations Centre (SOC) service. The engagement includes establishing a continuous 24x7x365 capability to detect, triage, investigate, and respond to information security events and incidents across the agency’s systems. The selected provider will be responsible for providing, hosting, operating, and maintaining an enterprise-grade SIEM platform, including underlying infrastructure, licensing, storage, and tuning, for the full contract term.

The service will require ingestion, normalisation, parsing, enrichment, and correlation of logs and telemetry from all in-scope sources, including revenue platforms, web application firewall systems, firewalls, Active Directory, AWS and other cloud workloads, endpoint detection and response tools, email gateways, network devices, servers, and databases. The provider must supply continuous monitoring through qualified SOC analysts with full coverage, including public holidays, and operate a tiered analyst model with L1, L2, and L3 functions supported by defined escalation paths.

The scope also includes development and maintenance of a detection use-case library aligned to a recognised framework such as MITRE ATT&CK. Required coverage includes unauthorised access, account takeover, credential abuse, mass record enumeration, insecure file upload abuse, web application attacks, malware, data exfiltration, and privilege escalation. In addition, the vendor must establish a threat intelligence function, integrate multiple threat intelligence feeds into the SIEM, and conduct proactive threat hunting at least monthly.

During incident response activities, the provider must support proper identification, collection, acquisition, and preservation of evidence in a forensically sound manner while maintaining chain of custody suitable for disciplinary, regulatory, or legal proceedings.