A Pilbara iron-ore operator, with a Perth analyst on every shift.

The operator’s roster of ~60 swung between two Pilbara sites on an 8/6 rotation, with corporate backbone over satellite, LTE and microwave — not the CBD fibre the previous provider’s tooling was tuned for. Tickets had been escalating for two quarters: incidents opened late in a swing that needed a FIFO dispatch arrived back as “on the next rotation” with no clear ownership; alerts fired in the AWST window landed in an interstate queue where the analyst didn’t know what the link looked like.

The asset list was the immediate problem. Hardened laptops came and went on every swing; the asset register ran a fortnight behind real life. Patching cadence was effectively nil, because the only way to get patching through was a swing-end build-up that was always the first thing cut when a swing ran long. EDR coverage stopped at the corporate backbone; site-edge devices ran unmanaged.

The internal threshold for change was operational, not financial: a senior supervisor who had logged the after-hours reach problem for two years, a Perth-based operations team that wanted tickets read in their timezone, and a roster of FIFO engineers who wanted a published rotation so dispatch was predictable.

We took over the environment in a 30-day handover. SOC shifts moved to a rostered Perth analyst on every shift — the same person who knew the operator’s two Pilbara sites, not a queue that didn’t know what a Pilbara site looked like. Detection was retuned for satellite, LTE and microwave links: link-flap thresholds appropriate to the technology, suppression tuned for the long ACSC-aligned alert model, and an AWST escalation matrix written down before the first shift, not improvised at 2am.

FIFO rotation became published rather than improvised. A FIFO-capable engineer carrying each site on the rotation, a visit window the supervisor could plan around, and replacement hardware staged at Jandakot so it goes out on the next swing without a Perth office detour. Patching moved off the swing-end build-up entirely; the AWST-window patching cadence doesn’t need a swing to land.

Asset register, which had been the supplier’s biggest liability, moved to a fortnightly reconciliation run by the Perth analyst on shift — reconciled against the swing data, signed off at the end of each rotation. Ticketing moved from “next rotation” as a default to a per-alert AWST acknowledgement, with a written matrix of what warrants a FIFO dispatch and what doesn’t.

Detection tuned for satellite, LTE & microwave links — not written for a CBD fibre run.

Over the first six months of the new model, mean-time-to-acknowledge moved from a 14-hour median (the operator’s own figure, across the previous twelve months) to a 23-minute median (our SOC data, AWST window). FIFO dispatches actually happened on the swing they were opened on, because the next FIFO rotation was the same FIFO rotation we had a published slot in. The supervisor’s two-year habit of double-checking every alert for a “did this one land in interstate” symptom went away inside the first quarter.

Asset register reconciled fortnightly instead of running a fortnight behind. EDR coverage extended from corporate backbone to site-edge devices; the AWST-window detection ran with a Pilbara-tuned suppression profile rather than the inland-NSW default the previous provider had shipped. Patching cadence, run from the AWST window, no longer needed a swing-end build-up — so it stopped being the first thing cut when a swing ran long.

Measured against the agreed dashboard, the posture delta is real, and the most measurable part of it is operational — the supervisor’s working week, the FIFO engineers’ published rotation, and the Perth analyst’s AWST-window coverage rather than a national queue’s weighted average. The engagement remains active; outcomes below are measured against the quarter the work shipped.