Security Operations Center (SOC) Analyst L1/L2

ABOUT US

Würth IT is the internal IT service provider of the global Würth Group, a world market leader in fastening and assembly materials with operations in more than 80 countries. We are expanding our cybersecurity capabilities in Malaysia and looking for curious, motivated people to join our global Cyber Defense Center (CDC).

You will work alongside cybersecurity professionals in Malaysia, Europe and North America to help protect the Würth Group’s networks, systems and services. Our teams share knowledge, support one another during investigations and keep improving how they work.

We value more than years of experience. Technical interest, strong academic performance, practical learning and the willingness to keep developing all matter to us. We welcome experienced SOC professionals and high-performing graduates who want to begin a career in cybersecurity.

JOB DESCRIPTION

Your work will help the Würth Group detect security threats, understand their impact and respond effectively. You will monitor security activity across a large international IT environment, investigate incidents and turn technical evidence into clear findings that others can act on.

The role includes both initial assessment and more detailed investigation. You will work within established SOC processes while using your judgement when a case needs a closer look.

RESPONSIBILITIES

• Security monitoring: Monitor alerts, systems and networks for signs of suspicious activity. Identify and classify potentially malicious activity, priorities alerts and vulnerabilities, and identify problems that could affect the effectiveness of monitoring tools.

• Incident investigation and response: Take ownership of investigations within your area of responsibility, including cases that need analysis beyond initial triage. Establish the scope, urgency and impact, take appropriate action within SOC procedures, and escalate critical or specialist matters with clear findings and recommendations.

• Case management: Track incidents and anomalies in the ticketing system from detection through to resolution. Examine endpoint, network, identity, email and cloud data; investigate likely causes; and work with relevant teams on corrective actions.

• Threat intelligence and continuous learning: Keep up to date with emerging threats, attack techniques and relevant vulnerabilities. Apply what you learn to investigations, share useful findings with the team, and help improve detections and playbooks.

• Documentation and reporting: Keep case records, investigation notes and handovers accurate. Help maintain SOC procedures, knowledge-base articles and relevant system-configuration documentation. Contribute to reports on security events, incident trends and key observations for leadership.

• Tools and processes: Follow established playbooks while applying your judgement when a case does not fit them neatly. Identify gaps in tools, detections or procedures, and work with the team to put agreed improvements and automation into practice.

• Collaboration and knowledge sharing: Work with SOC colleagues, security specialists, system administrators and network engineers to resolve incidents. Share investigation methods and lessons learned, and provide technical guidance to colleagues on cases within your area of expertise.

• Responsible use of AI: Use AI-assisted tools where they help with investigation, analysis or documentation. Check their output against the evidence and follow security and confidentiality requirements.

QUALIFICATIONS AND SKILLS

You do not need to know every tool or technology listed below. We want to see sound technical foundations, careful thinking and a willingness to learn.

Experience and Education

• Experienced applicants: At least 2 years of experience in an SOC, incident response, cybersecurity operations or a similar environment, with practical experience investigating alerts and incidents. Hands-on SIEM experience is particularly important.

• Early-career applicants: Recent graduates are encouraged to apply; professional SOC experience is not required. We will consider your academic results, particularly in cybersecurity, networking, operating systems or programming, along with your technical foundations, projects, internships and the steps you have taken to learn cybersecurity beyond your coursework.

• Qualifications: A bachelor’s degree in cybersecurity, computer science, information technology, computer or network engineering, digital forensics, software engineering or a related technical field, or equivalent qualifications and relevant experience.

Technical knowledge

• Security fundamentals: Understanding of common attack techniques, monitoring, incident investigation, threat detection, log analysis and basic digital forensics.

• Networking and systems: A good understanding of operating systems, network security and protocols such as TCP/IP, HTTP/HTTPS, DNS and LDAP. Familiarity with DHCP, SMTP, FTP, VPNs and firewalls is also useful.

• Security technologies: Experience or exposure to SIEM, EDR/XDR, email, network, identity or cloud security, threat intelligence, and vulnerability management. We do not expect experience with every technology.

• Scripting and automation: Knowledge of Python, PowerShell, KQL, SPL, APIs or other automation tools is an advantage.

Practical learning and AI

• Hands-on learning: CTF competitions, TryHackMe, Hack The Box, cyber ranges, home labs, bug bounty programmes or personal security projects.

• Projects and community: Final-year projects, security research, coding projects, open-source contributions, certifications, university cybersecurity clubs, conferences or meetups.

• AI mindset: Interest in how generative AI, security copilots and automation can support SOC work. You are willing to try new tools, write effective prompts and check their results against other evidence. Professional AI development experience is not required.

These are examples, not a checklist. We are interested in what you have done and what you learned from it.

Personal skills

• English: Fluent written and spoken English for investigations, documentation, handovers and collaboration across our global SOC.

• Analytical thinking: You follow the evidence, ask why something happened and explain your conclusions clearly.

• Initiative: You take ownership, propose sensible next steps and raise issues without waiting for every action to be assigned.

• Teamwork: You share knowledge, ask questions when needed and challenge assumptions constructively.

• Curiosity: You care about cybersecurity and want to keep developing your skills, including learning from mistakes.

WORKING IN OUR GLOBAL SOC

Our SOC operates on a follow-the-sun model. Teams in Malaysia, Europe and North America work during their local daytime hours and hand over investigations between regions to provide 24-hour coverage.

Team members take turns working on weekends and public holidays.

The role may also involve occasional travel to other SOC locations for collaboration, training and knowledge sharing.

JOIN US

You will gain practical experience in modern security operations and learn from colleagues across our global team. Whether you bring professional SOC experience or are a graduate with strong technical foundations and a genuine interest in cybersecurity, we would like to hear from you. Tell us about the investigations, projects or practical learning that have shaped your interest in this work.