Security Operations Centre Services

Sheridan, a government authority located in Ontario, is seeking a vendor to provide twenty-four-seven-three-hundred-and-sixty-five security operations centre services. The agency requires continuous security monitoring, detection, investigation, and incident response coordination to protect its digital environment. The selected partner must deliver measurable service level agreements and key performance indicators, including specific metrics for detection, triage, containment, mean time to resolution, and false positive rates. The scope of work covers the ingestion of logs from Microsoft Windows 10 and above, Linux, and MacOS, as well as telemetry from Microsoft Defender sources and network security systems like Cisco firewalls, VPNs, IDS/IPS, and WAF. The agency requires the vendor to operate a defined alert handling workflow spanning ingestion, validation, classification, triage, escalation, investigation, containment, and closure. Additionally, the service must include continuous, hypothesis-driven threat hunting with defined deliverables and ongoing detection content tuning. Bidders must be onshore organizations based in Canada to be eligible for this opportunity. The agency requires the vendor to adhere to compliance frameworks such as ISO 27001 and SOC 2 Type II, providing evidence of current certifications, and to enforce multi-factor authentication and privileged access management for the security platform. The performance of the work will take place both onsite and offsite over a contract period of three years. The agency is looking for proposals to determine the budget for this initiative. Bidders must submit any questions regarding this opportunity no later than June 29, 2026. Responses must be submitted digitally via email or through the designated online portal.