QLD Treasury hunting for MDR partner

Queensland Treasury is seeking to engage a partner for the provision of cyber security managed detection and response services through a Security Operations Centre (SOC).

This includes the monitoring, detection, analysis, response and containment of internal and external cyber security threats, events, and incidents specific to Treasury, along with continuous threat hunting based on cyber threat intelligence.

The objectives of the tender are to enhance Treasury’s organisational procedures and processes and embedding a cyber security culture to support cyber security uplift, as well as protecting Treasury’s information from unauthorised access, use, modification, disclosure and loss.

Augmenting Treasury’s ability to manage its staff and partners, and their access to information, along with preparing Treasury to respond to and recover from cyber security incidents, mitigating operational impacts, were also identified as objectives.

The currently technology used by the government agency includes Microsoft Defender for Endpoint, Microsoft Defender for Identity, Sentinel, Azure Data Explorer, Azure Data Explorer Cluster, Sentinel Data Lake, NetScope, ProofPoint, Syslog, Azure, AWS and multi-tenant Sentinel architecture. 

Treasury's endpoints and infrastructure are multi cloud (AWS, Azure and private), with around 2,800 user devices, 200 servers and 270 Mobile Devices (phones and tablets).

The successful vendor must have experience and expertise with a multi-tenant Sentinel architecture leveraging analytics and auxiliary logs; operating using GDAP/LightHouse/MTO; Microsoft USX; and managing external data sources such as storage accounts.

They must also have experience managing analytical rules including NRTs; threat hunting rules; ASIM and parsing; automation including rules and playbooks; and watchlists and workbooks.

The contract is for 24 months,with an option to extend three times in 12 month increments.

The closing time and date of the tender is 4:00pm on 31 October 2025.

Last month, the Queensland government's Department of Transport and Main Roads released an EOI to provide managed services for the establishment of a co-managed SOC.