Specialists - L1 SOC Analyst

PwC; Kuala Lumpur; On-site; MYR 30,000 - 40,000; Full time

Job summary

A leading professional services firm is seeking an L1 SOC Analyst in Kuala Lumpur. You will monitor alerts and investigate complex cybersecurity issues as part of a dedicated team. Key responsibilities include triaging alerts, collaborating with server owners, handling Jira tickets, and potentially escalating security incidents. The ideal candidate should have a degree in a relevant field and possess attention to detail and strong communication skills. Opportunity for growth in threat hunting skills is available in this role.

Qualifications

• 0-1 year of experience in Cybersecurity, SOC, or Surveillance.
• Basic understanding of networking concepts (e.g. TCP/IP, DNS, HTTP).
• Familiarity with operating systems (Windows, Linux).
• Willing to uplift threat hunting skills.

Responsibilities

• Monitor for newly triggered alerts and collect more information.
• Ensure clear handovers during shift changes.
• Investigate logs not flowing to SIEM and report to server owners.
• Attend to Jira tickets and respond to inquiries.

Skills

Attention to detail

Strong communication skills

Team collaboration

Education

Degree or diploma in Computer Science, Information Security, or related field

Tools

SIEM platforms (e.g. Wazuh, Splunk)

EDR/XDR (e.g. MDE, Cortex, CrowdStrike, Sophos)

Firewalls and IDS/IPS systems

Ticketing tools (e.g. Jira)

Job description

As a L1 SOC Analyst, you'll work as part of a team of problem solvers, helping to solve complex business issues from strategy to execution. PwC Professional skills and responsibilities for this management level include but are not limited to:

Responsibilities

• Alert Triage & Investigation
  • Monitor for newly triggered alerts. Also look for alerts not yet marked as Open or Closed
  • Collect more information to support the theory of the alerts under assessment
  • Correlate alerts with other security devices
  • Investigate the impact of the alerts

• Ensure that shift handovers are conducted clearly and concisely, which includes:
  • Participating in shift handover process
  • Conducting shift handover
  • Preparing shift handover report
  • Communicating shift handover information to next shift personnel

• Monitor and investigate if the logs from the stopped flowing to SIEM. Reach out to the Server owner, generate a list and work on the list, report the ones resolved and the method used.
  • Linux - Syslogs - get in touch with server owner
  • Windows - check for permission, user status (disabled/activate), password expiry (local user). User ID for windows collections is Irsvrcollector.

• Attend to Jira tickets sent to the client. Response to inquiry or forward the ticket to the respective group/team.

• Detect and report ticket with log parser issue to Infra/SIEM Engineer.

• Detect and report ticket with False Alarm to Infra/SIEM Engineer.

• Authorise to review and analyse alerts generated by security tools and systems.

• Empower to escalates potential security incidents to higher-level analysts (L2 or L3) based on predefined criteria.

Qualifications

• Degree or diploma in Computer Science, Information Security, or related field.
• 0-1 year of experience in the area of Cybersecurity, SOC or Surveillance.
• Certifications (optional but beneficial).
• Offensive mindset is a plus.
• Willing to uplift threat hunting skill as part of career development.
• Basic understanding of networking concepts (e.g. TCP/IP, DNS, HTTP, etc.).
• Familiarity with operating systems (e.g. Windows, Linux).
• Knowledge of security and operational tools such as:
• • SIEM platforms (e.g. Wazuh, Splunk).
  • EDR/XDR (e.g. MDE, Cortex, CrowdStrike, Sophos).
  • Firewalls and IDS/IPS systems.
  • Familiarity with ticketing and workflow tools (e.g. Jira) is a plus.
• Strong communication skills (English is a must, Cantonese is a plus) – ability to document incidents and escalations appropriately.
• Attention to detail – crucial for identifying anomalies in logs and alerts.
• Team collaboration – working with other SOC tiers and cybersecurity teams.
• Willingness to work in shifts – SOC often operate 24/7.