Cybercrime Operational Lead

About this role

Details

National: £58,541 - £64,624

London: £65,869 - £72,711

Plus a Flexibility Payment - See attached document

External applicants will join on the pay band minimum.

A Civil Service Pension with an employer contribution of 28.97%

GBP

Job grade

Business area

HMRC - CCG - Fraud Investigation Service

Type of role

Intelligence

Investigation

Working pattern

Flexible working, Full-time, Job share, Part-time

Number of jobs available

1

Contents

•

About the job

•

Benefits

•

Things you need to know

•

Apply and further information

About the job

Job summary

Discover what it’s like to work in a compliance role that makes an impact. Could you help us shape a stronger, fairer future? Your next career move starts here.

HMRC’s Fraud Investigation Service (FIS) is responsible for the department’s civil and criminal investigations.

Covert Operations, Digital Exploitation (CODE) sits within FIS. Working across Law Enforcement and government, CODE provides investigative tools and covert techniques to front-line investigations and works with key partners to develop and provide access to new technology and systems to enable investigators to respond to serious and complex tax evasion and crime.

The FIS CODE Cybercrime Team tackles evolving cyber threats to HMRC through intelligence, investigations, forensic analysis, and cyber expertise. We provide actionable insight to strengthen systems, improve resilience, and inform countermeasures protecting HMRC’s digital services. By gathering critical evidence, intelligence and data, we enable confident decision-making that secures systems used by millions of taxpayers and supports UK public services. Our work also involves disrupting major criminal networks and those who enable them.

The Team operates under 3 areas

Strategy & Business Management: Sets and ensures delivery of the team’s strategic direction in line with HMRC’s wider objectives.

Technical Investigation: Uses specialist cyber investigators to carry out digital forensics, data analysis, and malware investigations to identify and develop cybercrime cases and strengthen HMRC’s defence.

Intelligence, Investigation & Operational Engagement: Deploys cybercrime criminal investigators to use covert and sensitive intelligence capabilities, progress investigations, UK and international partnerships to detect cybercrime threats and respond to online criminal actors targeting HMRC services, data, and customers.

For more information about our Directorates, Lines of Business and some of our roles, please visit the FIS Careers pages https://www.civil-service-careers.gov.uk/hmrc-fraud-investigation-service/.

Job description

This role of Cybercrime Operational Lead will be an additional second post alongside an existing postholder. Together, the Cybercrime Operational Leads will provide joint responsibility to lead the growing Intelligence, Investigation & Operational Engagement area.

The role is responsible for HMRC’s cybercrime intelligence and investigation strategy, delivering against FIS tactical priorities and directly supporting wider departmental and cross government strategic outcomes.

As a Cybercrime Operational Lead, you will be involved in some of the most challenging yet rewarding work within law enforcement.

Cybercriminals can be inventive and ingenious with technology, just as you will need to be innovative when using HMRC’s wide-ranging legal powers and investigative techniques in response. You will use your investigative skills and cybercrime knowledge to help define, prioritise and delivery the tactical and operational strategies for cybercrime investigations.

Critical to your success are your people. Working together with the wider senior management team, you will be focused on maintaining a positive, inclusive, innovative and confident culture across the Cybercrime team. This is against a backdrop of significant and fast-paced change including continued team and capabilities expansion through Spending Review (SR) investment.

The FIS Cybercrime Team is located across HMRC’s regional centres at Stratford in London, Manchester, Leeds and Nottingham. You will occasionally be required to attend these locations in addition to your home office location and may have to stay overnight. Due to the operational activity conducted by the team, you will occasionally be required to work away from the office in the UK and overseas.

Person specification

The successful candidate will

•

Lead intelligence assessment and operations: Ensuring progression of appropriate investigative and disruption opportunities, directing complex, multi-agency and cross-jurisdiction investigations through to completion, working closely with CPS Cyber leads.

Deliver operational outcomes: Oversee safe and effective delivery of operations, in cognisance to strategies and FIS operational plans, pursuing criminal investigations or alternative disruption strategies as appropriate to achieve maximum impact and value from intelligence.

•

Manage and lead teams: Provide leadership, direction, and operational assurance to cybercrime investigators across multiple locations.

•

•

Build strategic partnerships: Develop and maintain effective relationships withing HMRC, UK and international law enforcement, intelligence, and industry partners to represent HMRC and support its cybercrime mission.

Maximise intelligence capabilities: Leverage HMRC and key law enforcement sensitive intelligence capability to direct and access vital insights and intelligence on current and emerging online fraud and cybercrime threats.

•

Collaborate across CODE Cybercrime functions: Work closely with Cybercrime Technical and Strategy Leads to fully utilise specialist expertise and maximise operational impact.

•

• Capture and apply insight: Ensure knowledge of criminal techniques and HMRC system vulnerabilities is recorded and used to inform departmental risk management and mitigation strategies.

In order to undertake these key responsibilities, we are seeking candidates who have

Proven success in engaging stakeholders in order to build relationships across government and law enforcement within the UK and internationally.

•

• Proven success in implementing strategy through tactical objectives and delivering measurable outcomes

Strong collaborative skills, with the ability to work dynamically and under pressure with colleagues across investigative and intelligence disciplines to achieve successful outcomes

•

•

Clear and confident communication skills, with ability to explain findings, develop investigative rationale and engage effectively with both internal stakeholders and external partners at all levels

Successful candidates will need to effectively develop and apply subject matter expertise. This includes

•

Knowledge of UK cybercrime threats, online criminal marketplaces and enabling cybercrime services, especially activity linked to cashing-out.

•

Understanding of end-user devices, networks and internet services in the context of cybercrime investigations

Additional Security Information

In addition to the standard pre-employment checks for appointment into the Civil Service, all candidates must also obtain National Security Vetting at Security Check (SC) clearance level for this vacancy. You will normally need to meet the minimum UK residency period as determined by the level of vetting being undertaken, which for SC is 5 years UK residency prior to your vetting application. Once in post you will be required to apply for Developed Vetting ( DV ) clearance which has a requirement for 10 years UK residency. If you have any questions about this residency requirement, please speak to the vacancy holder for this post. This post is open to ‘UK Nationals Only’.

CODE have a support network that can offer assistance to colleagues throughout the DV process.

About cyber security & digital forensics roles for ex-police

Cyber security, digital forensics and incident-response roles. DMIs, cybercrime investigators and digital forensics officers bring evidential discipline and investigative judgement that DFIR and security teams struggle to hire.