Senior Cybercrime Technical Investigator
HM Revenue and Customs
Apply before 11:55 pm on Thursday 20th February 2025
Details
Reference number
Salary
Plus a Flexibility Payment, please see attached document
Job grade
Contract type
Business area
Type of role
Working pattern
Number of jobs available
Contents
Location
About the job
Job summary
Discover a career in your hands at HMRC. Whether you're seeking purpose, growth, or a workplace that gives you a true sense of belonging, hear from some of our employees as they share their story about what it’s really like to work at HMRC.
Visit our YouTube channel to watch the full series and come and discover your potential.
HMRC’s Fraud Investigation Service (FIS) is responsible for the department’s civil and criminal investigations.
FIS provides HMRC with an effective investigation arm to enforce the Department’s compliance policies. This enables the Department to deliver against the strategic responsibilities across all the taxes and duties it administers. This includes complex offshore evasion, international smuggling of illicit excise goods, exports of controlled weapons and technology, labour market abuses, VAT and Self-Assessment repayment frauds and a host of other fraud attacks targeted at the tax system.
FIS is home to a wide range of people with a variety of skills and professional backgrounds – including accountants, cybercrime specialists, criminal justice professionals, tax professionals and operational delivery support teams to name but a few. We use a range of powers and approaches to protect funding for UK public services, investigating the most harmful tax cheats and ensuring nobody is beyond our reach.
Covert Operations, Digital Exploitation (CODE) sits within HMRC’s wider Fraud Investigation Service (FIS). Working across Law Enforcement and government, CODE provides investigative tools and covert techniques to front-line investigations and works with key partners to develop and provide access to new technology and systems to enable investigators to respond to serious and complex tax evasion and crime.
Job description
The Cybercrime Team utilise a range of technical capabilities, Intelligence tools and investigative work to detect, mitigate and investigate the most significant attacks against HMRC’s online services, our customers, and our data.
Consisting of 3 strands working together to reduce cyber enabled harm to UK citizens, businesses and HMRC from organised criminal networks using technology to fraudulently access customers devices and online accounts.
Strategy and Business Management
This key area underpins and brings together the vision, purpose, and insights of the Cybercrime team. It ensures the ambition, strategic direction and priorities for the teams Strategy are set and actioned against HMRC’s Strategy, the Risk Treatment Plan and Tactical priorities.
Business Management fulfils a variety of roles and functions in support of the Senior Leadership Team and wider team, including, inbox/diary management, recruitment, change management, knowledge management, including training and corporate assurance.
Technical Investigation
The Technical Investigators use their specialist skills in Digital Forensics, online log data analysis, malware analysis and knowledge of cyberspace and cybercriminals’ tactics working alongside investigators to identify and develop investigations from inception to producing technical evidence for court. They use this insight to enhance HMRCs capability to defend and investigate cybercrime attacks.
Intelligence, Investigation & Operational Engagement
This area of the team utilises a range of covert and sensitive intelligence, investigation capabilities and partnerships to detect cybercrime attacks and identify online criminal actors posing a threat to HMRC online services, our data and customers.
They conduct criminal investigations where appropriate and act as HMRC’s link into the Cybercrime Law Enforcement and Intelligence communities in the UK and with our key international partners.
This is underpinned by specialist Cybercrime intelligence coordination unit and Dedicated Disclosure Teams.
Person specification
The Cybercrime team gather intelligence and investigate online fraud against HMRC and its enablers, which provides evidence-backed risk insight and advice to shape the security of HMRC services, fraud prevention and criminal justice outcomes.
The successful candidate will work collaboratively as part of the team, leading on one of the following: digital forensic analysis of seized devices, internal and external technical data sources and investigating the impact of cyber-crime on HMRC systems and services.
We are looking for an experienced cybercrime or digital forensics technical expert to join our growing team. You must possess real enthusiasm and drive for the topic, constantly looking for new methods to enhance our visibility, awareness and capabilities.
You will be leading a team of technical investigators, utilising their range of skills as digital forensic examiners, data analysts and their technical cybercrime knowledge to compliment the cybercrime investigators within the team and wider Fraud Investigation Service to achieve fraud prevention and criminal justice outcomes.
As a leader, you’ll help manage and develop the team, providing coaching and maintain strong technical relationships with government and industry.
In this fast-paced environment, day to day task will include:
• Leading on the technical cybercrime aspects of HMRC criminal investigations by collating analysing and explaining a variety of internal and external data sources to support criminal justice outcomes.
- Provide witness statements, expert witness testimony (where required, attending court in support of Criminal investigations as required.
- Devise new technical methodologies as required, carrying out experiments to validate findings and results.
- Keeping abreast of emerging technologies and methodologies that impact the work of the cybercrime team.
- Provide expert advice and education on aspects of cybercrime threats and techniques to criminal investigation teams.
- Acting as a technical consultant assisting operational, policy and software development teams with advice on defensive and detective methods to counter cyber-crime threats.
- Maintaining knowledge on cybercrime and cyber security through personal development and research.
- Deputising on occasion for the head of Cybercrime Technical Investigation.
- To act as a Subject Matter Expert (SME) providing leadership and knowledge across the team and the department, advising on the development, operation, and improvement of digital services to be resilient against cybercrime, communicating across professions, from Programme Boards to software developers.
- This role comes with the expectation of regular travel to HMRC Regional Centres, particularly Bristol, Stratford or Nottingham.
- Become a member of an approved professional body, e.g. CIISec
Essential Criteria: - A Degree or higher in Cybercrime/Cyber Security or similar STEM/technical degrees e.g. Computer Science/Digital Forensics. High Level qualifications such as GIAC (e.g. GCFE, GREM, GCIH, GCTI), CISSP, OCSP, etc. will be considered in lieu of a degree.
- Demonstratable experience working in Cybercrime investigation/Cyber Security/incident response/Digital forensics role.
- Expertise & knowledge in one of the 3 strands of:
o Digital forensic analysis, including malware & victims to FSR Codes of Practice.
o Analysis, interpretation and advanced fraud detection using Transaction Monitoring.
o Cybercrime landscape, TTPs & Capability
- Possess an ability to examine digital evidence in a methodical and precise way and have an aptitude for problem solving – experience the FSR Codes of Practice – experience of the use of commercial and open-source DFIR tools.
- The ability to work with large & complex data sets such as online system logs, event logs from digital forensics and cybercrime C2 and marketplaces.
- Able to thrive in a fast-paced, dynamic environment by effectively adapting to change, managing pressure, and prioritising tasks to meet deadlines both independently and as part of a specialised team.
- Knowledge of relevant UK law enforcement legislation would be advantageous (CPIA, PACE, IPA, RIPA, CMA)
- Hold National Security Vetting at Security Check (SC) clearance level or be willing to apply for and be able to achieve SC vetting.
Desirable Criteria:
- Knowledge tax and investigating tax fraud
- A full UK Driving Licence - including manual transmission.
We recognise that some people cannot drive due to a disability or underlying health condition and may not be able to meet this requirement. Where this applies, you can apply but will need to declare that you require a reasonable adjustment at the point you receive a provisional offer. The vacancy holder will then discuss your specific requirements to consider if this can be reasonably accommodated in this role.
Desirable criteria is not essential for the role but may be considered by the vacancy-holder where candidates have the same scores at interview.
Further Information:
Training Requirements:
You will undergo a 12 month Training and Assessment Period (TAP) during which you will be required to:
- Complete SANS401 training and GIAC exam pass
- Complete and pass Core Skills in Data Recovery & Analysis course.
Public and Personal Safety Training (PPST)
Applicants will be required to be cleared by an occupational health assessment to be able to attend a public and personal safety training (PPST) course. Successful completion of the PPST is required to undertake duties away from the office for this role. Failure to pass and maintain the PPST certificate may affect receipt of the flexibility payment.
Flexibility Payment
This post attracts a Level 2 Flexibility Payment (FP) that is paid monthly with salary. This FP allows HMRC flexibility to change your work pattern, at short notice, to meet business needs. You will be expected to undertake periods of On Call. You will also be expected to work additional hours, at weekends and outside your normal working hours/days (including bank holidays).
In applying for a position and accepting the FP you agree that you can and will meet those attendance requirements.
FP levels are reviewed annually – on a business need and personal basis – and may be subject to change.
If you currently receive the Flexibility Payment, which may include Transition Protection and/or a Maintained Pension Value, moving to a new role may affect your payments.
Integrity Declaration Statement
All applicants will be required to declare any past convictions, criminal findings, or police cautions, regardless of whether they are ‘spent’. You must also declare any disciplinary proceedings relating to current and previous employments. The disclosure of this information will not automatically bar you from employment with FIS, but we need to be aware of any event or issue which could impinge on your credibility especially in roles where you may be required to give evidence in court. FIS will conduct background checks and any offer will be withdrawn if you fail to disclose any relevant information that causes conflict with you being able to complete the duties of the role. Internal candidates should also be aware that if they fail to disclose relevant information, they could be subject to disciplinary proceedings under HMRC’s Upholding Our Standards of Conduct policy.
This role requires security clearance to a minimum of SC with an expectation that DV could be achieved as required. Any job offer is conditional to the attainment of the security clearance to SC and thus, the security clearance is mandatory. Please be aware that those who do not attain the required security clearance will not be allowed to carry on in this particular post.
Applicants who wish to work alternative working patterns are welcome to apply. The preferred working pattern may or may not be available, agreement will be subject to business need, and any request to work an alternative working pattern should be made prior to your acceptance of the provisional offer.
Depending on individual circumstances and the requirements of the role we may be able to make reasonable workplace adjustments such as flexible working, adjusting breaks and time to complete tasks, providing alternative office equipment, software etc. A successful applicant would be able to discuss this with their manager.
Candidates must live within reasonable daily travel, of either Nottingham Regional Centre or Stratford Regional Centre.
Qualifications
Behaviours
We'll assess you against these behaviours during the selection process:
- Leadership
- Making Effective Decisions
Technical skills
We'll assess you against these technical skills during the selection process:
- Technical Skills will be assessed at interview by way of a presentation with follow up questions. Details regarding the presentation will be provided prior to interview.
Benefits
HMRC operates both Flexible and Hybrid Working policies, allowing you to balance your work and personal commitments. We welcome applications from those who need to work a more flexible arrangement and will agree to requests where possible, considering our operational and customer service needs.
We offer a generous leave allowance, starting at 25 days and increasing by as day for every year of qualifying service up to a maximum of 30 days.
- Pension - We make contributions to our colleagues’ Alpha pension equal to at least 28.97% of their salary.
- Family friendly policies.
- Personal support.
- Coaching and development.
To find out more about HMRC benefits and find out what it’s really like to work for HMRC hear from our insiders or visit Thinking of joining the Civil Service
Things you need to know
Selection process details
As part of the application process, you will be asked to provide the following:
- A CV – this must include MAX 250 words for career history and MAX 250 words for Skills and experience.
- A 750-word personal statement.
- Please complete a separate statement (Max 250 words) for the Desirable Criteria where applicable. This is not essential for the role but may be considered by the vacancy-holder where candidates have the same scores at sift or interview.
Personal Statement – In no more than 750 words evidence how your skills and experience would be suitable for the role, referring to the essential criteria as well as the personal specification outlined in the advert.
Further details around what this will entail are listed on the application form.
We acknowledge that AI can assist you in your application. Find our guidelines here.
Sift
A sift will be carried out on your CV and Personal Statement, with the successful candidates being invited to interview.
Your desirable criteria statement will not be scored and will only be used in the event of a tie break.
Interview
During the panel interview, your experience will be assessed, and you will be asked behaviour-based questions to explore in detail what you are capable of.
Your technical Skills will also be assessed at interview by way of a presentation with follow up questions. Details regarding the presentation will be provided prior to interview.
Interviews will take place face-to-face.
Sift and interview dates to be confirmed.
Eligibility
Please take extra care to tick the correct boxes in the eligibility sections of your application form. We understand mistakes sometimes happen but if you contact us later than two working days (Monday-Friday) before the vacancy closes, we will not be able to reopen your application for you. If you do make a mistake with your eligibility form, please contact us via: unitybusinessservicesrecruitmentresults@hmrc.gov.uk – Use the subject line to insert appropriate wording for example – ‘Please re-open my application – [insert vacancy ref] & vacancy closing date [insert date]’. To check that you are eligible to apply for this role, please review the eligibility information before submitting your application.
Reserve List
A reserve list may be held for up to 12 months from which further appointments may be made for the same or similar roles – if this applies to you, we’ll let you know via your Civil Service Jobs account.
Criminal Record Check
Applications received from candidates with a criminal record are considered fairly in accordance with the DBS Code of Practice and the Recruitment of ex-offenders Policy.
Merit List
After interview, a single merit list will be created, and you will only be considered for posts in locations you have expressed a preference for. Appointments will be made in strict merit order in line with the set number of roles in each location.
Reasonable Adjustments
We want to make sure no one is put at a disadvantage during our recruitment process. To assist you with this, we will reduce or remove any barriers where possible and provide additional support where appropriate.
If you need a change to be made so that you can make your application, you should:
- Contact the UBS Recruitment Excellence Team via unitybusinessservicesrecruitmentresults@hmrc.gov.uk as soon as possible before the closing date to discuss your needs.
Complete the “Assistance required” section in the “Additional requirements” page of your application form to tell us what changes or help you might need further on in the recruitment process. For instance, you may need wheelchair access at interview, or if you’re deaf, a Language Service Professional.
Additional Security Information
Please note: in addition to the standard pre-employment checks for appointment into the Civil Service, all candidates must also obtain National Security Vetting at Security Check (SC) clearance level for this vacancy. You will normally need to meet the minimum UK residency period as determined by the level of vetting being undertaken, which for SC is 5 years UK residency prior to your vetting application. If you have any questions about this residency requirement, please speak to the vacancy holder for this post.
Important information for existing HMRC contractual homeworkers:
Please note that this role is unsuitable for contractual homeworkers due to the nature and/or requirements of the role.
Terms and Conditions
Customer facing roles in HMRC require the ability to converse at ease with members of the public and provide advice in accurate spoken English and/or Welsh where required. Where this is an essential requirement, this will be tested as part of the selection process.
HMRC has a presence in every region of the UK. For more information on where you might be working, review this information on our locations.
The Civil Service values honesty and integrity and expects all candidates to abide by these principles. The evidence you provide in your application must relate to your own experiences.
Any instances of plagiarism or other forms of cheating will be investigated and, if proven, the relevant application(s) will be withdrawn from the process.
Recording of interviews is prohibited unless explicit agreement is sought in line with the UK General Data Protection Regulations.
Questions relating to an individual application must be emailed as detailed later in this advert.
Applicants who are successful at interview will be, as part of pre-employment screening, subject to a check on the Internal Fraud Database (IFD). This check will provide information about employees who have been dismissed for fraud or dishonesty offences. This check also applies to employees who resign or otherwise leave before being dismissed for fraud or dishonesty had their employment continued. Any applicant’s details held on the IFD will be refused employment.
A candidate is not eligible to apply for a role within the Civil Service if the application is made within a 5 year period following a dismissal for carrying out internal fraud against government.
New entrants will join on the minimum of the pay band.
Please note that, if you are applying for roles on a part-time basis, the salary agreed will be pro-rata, reflective of the working hours agreed within your contract.
If you experience accessibility problems with any attachments on this advert, please contact the email address in the 'Contact point for applicants' section.
Feedback will only be provided if you attend an interview or assessment.
Security
Nationality requirements
Working for the Civil Service
We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window).
Diversity and Inclusion
Apply and further information
Contact point for applicants
Job contact :
- Name : Paul Scott
- Email : paul.scott1@hmrc.gov.uk
- Telephone : 03000 538287
Recruitment team
- Email : unitybusinessservicesrecruitmentresults@hmrc.gov.uk
Further information
In the first instance, you should raise the matter directly via ubsrecruitmentcomplaints@hmrc.gov.uk. If you are not satisfied with the response, you may bring your complaint to the Commission. For further information on bringing a complaint to the Civil Service Commission please visit their website.
