You can network activate it, but you can't control Shield settings on a per-subsite basis. There is no provision to a subsite having different settings to either the main site, or another subsite.
We will be providing more granular controls for Sub-sites in a future Shield Pro release, though there is no ETA on this.
So, Shield protects multisites, but there are no controls available for admin of sub-sites.
Note: If you see anything strange with the behaviour for WPMS sites, please let us know and we'll take a look.