Cybercrime Investigator

Discover what its like to work in a compliance role that makes an impact. Could you help us shape a stronger, fairer future? Your next career move starts here.

As a Cybercrime Investigator, you will be involved in some of the most challenging yet rewarding work within law enforcement. You will be engaged with sensitive intelligence sources to identify online fraud and cybercrime threats to HMRC; identifying evidence gathering opportunities and planning interdictions.

You will liaise with internal and external intelligence and investigation partners in response to threats they identify. This will include teams across HMRC, wider government and law enforcement partners both in the UK (police forces, ROCUs and the NCA) and internationally.

You will use your investigative skills and cybercrime knowledge to support investigations and, at times, deploy operationally with HMRC and law enforcement partners to support interventions, which may include conducting searches of premises as well as preparing and conducting suspect interviews.

The nature of these investigations requires dynamic collaboration in real time utilising a wide range of techniques in digital pursuit of those attacking our services, including:

• Interrogation of departmental information systems;
• Analysis of transactional data on HMRC online services to identify lines of enquiry;
• Exploitation of Open Source and Digital investigation techniques;
• Analysis of financial intelligence and developing financial investigation strategies, including crypto-asset tracing;
• Analysis and exploitation of communications data to identify lines of enquiry;
• Obtaining a full range of surveillance and data acquisition authorities where appropriate;
• Support visits to HMRC customers who may have been victims to sophisticated cybercrime attacks, where you will work with forensic practitioners to gather digital evidence.

Additional Information

This post attracts a Level 2 Flexibility Payment (FP) that is paid monthly with salary. This FP allows HMRC flexibility to change your work pattern, at short notice, to meet business needs.

You will be expected to undertake periods of On Call. You will also be expected to work additional hours, at weekends and outside your normal working hours/days (including bank holidays).

In applying for a position and accepting the FP you agree that you can and will meet those attendance requirements.

Note: Payment of FP is dependent on successful completion of role specific training and you will move to Level 2 FP eligibility in stages (see the attached document for details).

FP levels are reviewed annually on a business need and personal basis and may be subject to change.

Details of the Flexibility Payment can be found in the attached document

Cybercriminals can be inventive and ingenious with technology, just as you will need to be innovative when using HMRCs wide-ranging legal powers and investigative techniques in response.

• Experience of working in an operational intelligence or investigation environment.
• Strong collaborative skills, with the ability to work dynamically and in real time with colleagues across digital, intelligence and forensic disciplines.
• Analytical and critical thinking ability, enabling you to assess complex digital, financial and communications data to identify meaningful lines of enquiry.
• Adaptability and curiosity, using a wide range of investigative techniques and adjusting approach as new information emerges.
• Excellent problem‑solving skills, applying judgement and creativity to develop effective investigation and financial intelligence strategies, including in technically complex areas such as crypto‑assets.
• Clear and confident communication skills, able to explain findings, develop investigative rationale and engage effectively with both internal stakeholders and external partners.
• Professional empathy and resilience, particularly when supporting customers who have been victims of sophisticated cybercrime.
• High levels of integrity and discretion, demonstrating sound judgement when handling sensitive information and operating within legal and ethical frameworks.
• Effective organisational skills, managing multiple lines of enquiry, priorities and authorisation processes in a fast‑paced investigative environment
• Flexibility, motivation and a thirst for learning
• Experience of working with a range of stakeholders across and beyond own business area.
• Ability to demonstrate an understanding of UK cybercrime threats, online criminal marketplaces and enabling cybercrime services, especially cash-out.
• Familiarity with online fraud detection systems in government, financial or the retail sector
• Familiarity with Cyber Threat Intel Analysis, including open-source techniques in relation to cybercrime and attribution.

Essential Criteria

You must demonstrate the following:

Experience in Utilisation of Criminal Justice procedures.

Experience working with Use of the powers within the Police and Criminal Evidence Act 1984 for posts in England and Wales, Police and Criminal Evidence (Northern Ireland) Order 1989 for posts in Northern Ireland and Criminal Justice (Scotland) Act 2016 & Criminal Justice and Licensing (Scotland) Act 2010 for posts based in Scotland.

Understanding Property Interference as defined within Police Act 1995 and the utilisation of the Regulation of Investigatory Powers (RIPA) Act 2000 and/or Investigatory Powers Act (IPA) 2016.

Applied knowledge of Criminal Procedure & Investigation Act 1996, (CPIA 96) ensuring strong standards of Disclosure Practise.

Experience of the creation or assurance of investigative strategies, applying technical competence to identify pertinent lines of enquiry including the day-to-day management of criminal investigation cases.

Experience of supporting operational activities to secure best evidence and an understanding of crime scene control, systematic search techniques and risk management.

Additional Security Information

In addition to the standard pre-employment checks for appointment into the Civil Service, all candidates must also obtain National Security Vetting at Security Check (SC) clearance level for this vacancy. You will normally need to meet the minimum UK residency period as determined by the level of vetting being undertaken, which for SC is 5 years UK residency prior to your vetting application. Once in post you will be required to apply for Developed Vetting ( DV ) clearance which has a requirement for 10 years UK residency. If you have any ...