Security Operations Center (SOC) Analyst L1/L2

Wurth IT Malaysia Sdn. Bhd.; Kuala Lumpur; On-site; MYR 60,000 - 120,000; Full time

Job summary

Würth IT Malaysia Sdn. Bhd. seeks a Security Operations Center (SOC) Analyst L1/L2 to help protect Würth Group assets across a large international IT environment.

You will monitor security activity, investigate incidents and translate technical evidence into clear findings for action. You will collaborate with teams in Malaysia, Europe and North America, applying established playbooks while contributing to detections, automation, and playbook improvements.

Qualifications

• Bachelor’s degree in cybersecurity, computer science, information technology, computer or network engineering, digital forensics, software engineering or related field, or equivalent qualifications and relevant experience.
• At least 2 years of experience in an SOC, incident response, cybersecurity operations or similar environment, with hands-on incident investigation.
• Hands-on SIEM experience is particularly important.

Responsibilities

• Security monitoring: monitor alerts, systems and networks for signs of suspicious activity and classify potential threats.
• Incident investigation and response: own investigations, define scope and actions, and provide findings and recommendations.
• Case management: track incidents from detection to resolution using the ticketing system and coordinate with relevant teams.
• Threat intelligence and continuous learning: stay updated on threats and apply learnings to detections and playbooks.
• Documentation and reporting: maintain case notes, handovers and SOC procedures; contribute to leadership reports.
• Tools and processes: follow playbooks, identify gaps, and propose improvements and automation.
• Collaboration and knowledge sharing: work with SOC colleagues and other teams to resolve incidents and share learnings.

Skills

English proficiency

Analytical thinking

Initiative

Teamwork

Curiosity

Education

Bachelor's degree in cybersecurity, computer science, IT or related field

Tools

SIEM

EDR/XDR

Cloud security

Threat intelligence

Vulnerability management

Job description

Security Operations Center (SOC) Analyst L1/L2

Würth IT is the internal IT service provider of the global Würth Group, a world market leader in fastening and assembly materials with operations in more than 80 countries. We are expanding our cybersecurity capabilities in Malaysia and looking for curious, motivated people to join our global Cyber Defense Center (CDC).

You will work alongside cybersecurity professionals in Malaysia, Europe and North America to help protect the Würth Group’s networks, systems and services. Our teams share knowledge, support one another during investigations and keep improving how they work.

We value more than years of experience. Technical interest, strong academic performance, practical learning and the willingness to keep developing all matter to us. We welcome experienced SOC professionals and high-performing graduates who want to begin a career in cybersecurity.

JOB DESCRIPTION

Your work will help the Würth Group detect security threats, understand their impact and respond effectively. You will monitor security activity across a large international IT environment, investigate incidents and turn technical evidence into clear findings that others can act on.

The role includes both initial assessment and more detailed investigation. You will work within established SOC processes while using your judgement when a case needs a closer look.

RESPONSIBILITIES

Security monitoring: Monitor alerts, systems and networks for signs of suspicious activity. Identify and classify potentially malicious activity, priorities alerts and vulnerabilities, and identify problems that could affect the effectiveness of monitoring tools.

Incident investigation and response: Take ownership of investigations within your area of responsibility, including cases that need analysis beyond initial triage. Establish the scope, urgency and impact, take appropriate action within SOC procedures, and elevate critical or specialist matters with clear findings and recommendations.

Case management: Track incidents and anomalies in the ticketing system from detection through to resolution. Examine endpoint, network, identity, email and cloud data; investigate likely causes; and work with relevant teams on corrective actions.

Threat intelligence and continuous learning: Keep up to date with emerging threats, attack techniques and relevant vulnerabilities. Apply what you learn to investigations, share useful findings with the team, and help improve detections and playbooks.

Documentation and reporting: Keep case records, investigation notes and handovers accurate. Help maintain SOC procedures, knowledge-base articles and relevant system-configuration documentation. Contribute to reports on security events, incident trends and key observations for leadership.

Tools and processes: Follow established playbooks while applying your judgement when a case does not fit them neatly. Identify gaps in tools, detections or procedures, and work with the team to put agreed improvements and automation into practice.

Collaboration and knowledge sharing: Work with SOC colleagues, security specialists, system administrators and network engineers to resolve incidents. Share investigation methods and lessons learned, and provide technical guidance to colleagues on cases within your area of expertise.

Responsible use of AI: Use AI-assisted tools where they help with investigation, analysis or documentation. Check their output against the evidence and follow security and confidentiality requirements.

QUALIFICATIONS AND SKILLS

You do not need to know every tool or technology listed below. We want to see sound technical foundations, careful thinking and a willingness to learn.

Experience and Education

Experienced applicants: At least 2 years of experience in an SOC, incident response, cybersecurity operations or a similar environment, with practical experience investigating alerts and incidents. Hands-on SIEM experience is particularly important.

Early-career applicants: Recent graduates are encouraged to apply; professional SOC experience is not required. We will consider your academic results, particularly in cybersecurity, networking, operating systems or programming, along with your technical foundations, projects, internships and the steps you have taken to learn cybersecurity beyond your coursework.

Qualifications: A bachelor’s degree in cybersecurity, computer science, information technology, computer or network engineering, digital forensics, software engineering or a related technical field, or equivalent qualifications and relevant experience.

Technical knowledge

Security fundamentals: Understanding of common attack techniques, monitoring, incident investigation, threat detection, log analysis and basic digital forensics.

Networking and systems: A good understanding of operating systems, network security and protocols such as TCP/IP, HTTP/HTTPS, DNS and LDAP. Familiarity with DHCP, SMTP, FTP, VPNs and firewalls is also useful.

Security technologies: Experience or exposure to SIEM, EDR/XDR, email, network, identity or cloud security, threat intelligence, and vulnerability management. We do not expect experience with every technology.

Scripting and automation: Knowledge of Python, PowerShell, KQL, SPL, APIs or other automation tools is an advantage.

Practical learning and AI

Hands-on learning: CTF competitions, TryHackMe, Hack The Box, cyber ranges, home labs, bug bounty programmes or personal security projects.

Projects and community: Final-year projects, security research, coding projects, open-source contributions, certifications, university cybersecurity clubs, conferences or meetups.

AI mindset: Interest in how generative AI, security copilots and automation can support SOC work. You are willing to try new tools, write effective prompts and check their results against other evidence. Professional AI development experience is not required.

These are examples, not a checklist. We are interested in what you have done and what you learned from it.

Personal skills

English: Fluent written and spoken English for investigations, documentation, handovers and collaboration across our global SOC.

Analytical thinking: You follow the evidence, ask why something happened and explain your conclusions clearly.

Initiative: You take ownership, propose sensible next steps and raise issues without waiting for every action to be assigned.

Teamwork: You share knowledge, ask questions when needed and challenge assumptions constructively.

Curiosity: You care about cybersecurity and want to keep developing your skills, including learning from mistakes.

WORKING IN OUR GLOBAL SOC

Our SOC operates on a follow-the-sun model. Teams in Malaysia, Europe and North America work during their local daytime hours and hand over investigations between regions to provide 24-hour coverage.

Team members take turns working on weekends and public holidays.

The role may also involve occasional travel to other SOC locations for collaboration, training and knowledge sharing.