Cybercrime Investigator - Leeds

About the job

Job summary Discover what it's like to work in a compliance role that makes an impact. Could you help us shape a stronger, fairer future? Your next career move starts here. The team is located across HMRC's regional centres at Stratford in London, Manchester, Leeds and Nottingham. You will occasionally be required to attend these locations in addition to your home office location and may have to stay overnight. Due to the operational activity conducted by the team you will occasionally be required to work away from the office in the UK and overseas.

The Cybercrime Team utilise a range of technical capabilities, Intelligence tools and investigative work to detect, mitigate and investigate the most significant attacks against HMRC's online services, our customers, and our data. Consisting of 3 strands working together to reduce cyber enabled harm to UK citizens, businesses and HMRC from organised criminal networks using technology to fraudulently access customers devices and online accounts.

• Strategy and Business Management: This key area underpins and brings together the vision, purpose, and insights of the Cybercrime team. It ensures the ambition, strategic direction and priorities for the teams Strategy are set and actioned against HMRC's Strategy, the Risk Treatment Plan and Tactical priorities. Business Management fulfils a variety of roles and functions in support of the Senior Leadership Team and wider team, including inbox/diary management, recruitment, change management, knowledge management, including training and corporate assurance.
• Technical Investigation: The Technical Investigators use their specialist skills in Digital Forensics, online log data analysis, malware analysis and knowledge of cyberspace and cybercriminals' tactics working alongside investigators to identify and develop investigations from inception to producing technical evidence for court. They use this insight to enhance HMRCs capability to defend and investigate cybercrime attacks.
• Intelligence, Investigation: Identifying evidence gathering opportunities and planning interdictions. You will liaise with internal and external intelligence and investigation partners in response to threats they identify. This will include teams across HMRC, wider government and law enforcement partners both in the UK (police forces, ROCUs and the NCA) and internationally. You will use your investigative skills and cybercrime knowledge to support investigations and, at times, deploy operationally with HMRC and law enforcement partners to support interventions, which may include conducting searches of premises as well as preparing and conducting suspect interviews.

The nature of these investigations requires dynamic collaboration in real time utilising a wide range of techniques in digital pursuit of those attacking our services, including:

• Interrogation of departmental information systems;
• Analysis of transactional data on HMRC online services to identify lines of enquiry;
• Exploitation of Open Source and Digital investigation techniques;
• Analysis of financial intelligence and developing financial investigation strategies, including crypto-asset tracing;
• Analysis and exploitation of communications data to identify lines of enquiry;
• Obtaining a full range of surveillance and data acquisition authorities where appropriate;
• Support visits to HMRC customers who may have been victims to sophisticated cybercrime attacks, where you will work with forensic practitioners to gather digital evidence.

Additional Information: This post attracts a Level 2 Flexibility Payment (FP) that is paid monthly with salary. This FP allows HMRC flexibility to change your work pattern, at short notice, to meet business needs. You will be expected to undertake periods of On Call. You will also be expected to work additional hours, at weekends and outside your normal working hours/days (including bank holidays). In applying for a position and accepting the FP you agree that you can and will meet those attendance requirements. Note: Payment of FP is dependent on successful completion of role specific training and you will move to Level 2 FP eligibility in stages. FP levels are reviewed annually - on a business need and personal basis - and may be subject to change.

Person specification: Cybercriminals can be inventive and ingenious with technology, just as you will need to be innovative when using HMRC's wide-ranging legal powers and investigative techniques in response. Experience of working in an operational intelligence or investigation environment. Strong collaborative skills, with the ability to work dynamically and in real time with colleagues across digital, intelligence and forensic disciplines. Analytical and critical thinking ability, enabling you to assess complex digital, financial and communications data to identify meaningful lines of enquiry. Adaptability and curiosity, using a wide range of investigative techniques and adjusting approach as new information emerges. Excellent problem‑solving skills, applying judgement and creativity to develop effective investigation and financial intelligence strategies, including in technically complex areas such as crypto‑assets. Clear and confident communication skills, able to explain findings, develop investigative rationale and engage effectively with both internal stakeholders and external partners. Professional empathy and resilience, particularly when supporting customers who have been victims of sophisticated cybercrime. High levels of integrity and discretion, demonstrating sound judgement when handling sensitive information and operating within legal and ethical frameworks. Effective organisational skills, managing multiple lines of enquiry, priorities and authorisation processes in a fast‑paced investigative environment. Flexibility, motivation and a thirst for learning. Experience of working with a range of stakeholders across and beyond own business area. Ability to demonstrate an understanding of UK cybercrime threats, online criminal marketplaces and enabling cybercrime services, especially cash-out. Familiarity with online fraud detection systems in government, financial or the retail sector. Familiarity with Cyber Threat Intel Analysis, including open-source techniques in relation to cybercrime and attribution.

Additional Security Information: In addition to the standard pre-employment checks for appointment into the Civil Service, all candidates must also obtain National Security Vetting at Security Check (SC) clearance level for this vacancy. You will normally need to meet the minimum UK residency period as determined by the level of vetting being undertaken, which for SC is 5 years UK residency prior to your vetting application. Once in post you will be required to apply for Developed Vetting (DV) clearance which has a requirement for 10 years UK residency. If you have any questions about this residency requirement, please speak to the vacancy holder for this post. This post is open to 'UK Nationals Only'. CODE have a support network that can offer assistance to colleagues throughout the DV process.

Training Requirements: If you do not already hold HMRC's full Criminal Investigation foundation programme qualifications a comprehensive training programme is provided. There will be a requirement for you to attend a three-week face to face training programme which may take you away from home. Through this training period you will be required to be available full-time. This training event will build on previous experience in the Law Enforcement arena and provide a refresh and upskilling in HMRC policy and procedure. For those that have not previously had the power to carry out an arrest under the Police and Criminal Evidence Act 1984, you will be required to attend a further one-week training event to acquire the skills and knowledge to carry out arrest and search of person. Both of these events are PASS/FAIL. Failure to reach the required standard on either of these events may result in you having to complete HMRC's full Criminal Investigation Foundation Training programme, which is 9 weeks and a mixture of digital and face to face events which you would need to be available for the full programme. Public and Personal Safety Training (PPST) is a crucial element of becoming a criminal investigator. This is a PASS/FAIL event. The event includes digital and face-to-face training where you will learn practical techniques to ensure your safety and that of your colleagues, as well as how to apprehend and physically restrain suspects and apply handcuffs. The event is mainly physical and includes scenario-based exercises where you will require an appropriate level of fitness and mobility such as being able to carry equipment up and down stairs and get up and down from the floor unaided. All officers undertaking this training must obtain a valid occupational health certificate (acquired from HMRC's healthcare provider) stating they are fit to undertake regular physical training. Once this training is complete, you will have a one-day refresher training event at least every six months after this to ensure you are able to carry out operational duties.

Role specific training: Cybercrime foundation training up to advanced practitioner and Cybersecurity essentials training within the first 18 months. Advanced OSINT (Open Source Intelligence). As part of ongoing professional development, depending on existing experience and qualifications, you will be expected to undertake training, ranging from in-house training to external courses. Training and Assessment Period (TAP) is 12 months. Applicants will be required to be cleared by an occupational health assessment to be able to attend a public and personal safety training (PPST) course. Successful completion of the PPST is required to undertake duties away from the office for this role. Failure to pass and maintain the PPST certificate may affect receipt of the flexibility payment. Candidates will be required to do an Authorised Officer Course.

Leeds Locations: Moves Adjustment Payment will be available for this role, provided the successful applicant is a current HMRC colleague in Bradford and meets the eligibility requirements outlined in the HMRC's Moves Adjustment Payment guidance.

Behaviours: We'll assess you against these behaviours during the selection process: Seeing the Big Picture Making Effective Decisions.

Benefits: Alongside your salary of £37,682, HM Revenue and Customs contributes £10,916 towards you being a member of the Civil Service Defined Benefit Pension scheme. HMRC operates both Flexible and Hybrid Working policies, allowing you to balance your work and personal commitments. We welcome applications from those who need to work a more flexible arrangement and will agree to requests where possible, considering our operational and customer service needs. We offer a generous leave allowance, starting at 25 days and increasing by a day for every year of qualifying service up to a maximum of 30 days. Pension - We make contributions to our colleagues' Alpha pension equal to at least 28.97% of their salary. Family friendly policies. Personal support. Coaching and development.

To find out more about HMRC benefits and find out what it's really like to work for HMRC hear from our insiders or visit Thinking of joining the Civil Service.

Things you need to know: Artificial intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action.

Selection process details: This vacancy is using Success Profiles, and will assess your Behaviours and Experience.

How to Apply: As part of the application process, you will be asked to provide the following: A name-blind CV including your job history, qualifications and previous experiences. A 750-word personal statement. Your personal statement should show how you meet the Person Specification and Essential criteria. Further details around what this will entail are listed on the application form.

Sift: In the event of a large number of applications being received, an initial sift may be held on the CV. At full sift your CV and your Personal Statement will be assessed, with the successful candidates being invited to interview. We may also raise the score required at any stage of the process if we receive a high number of applications.

Interview: During the panel interview, you will be assessed on Experience and Behaviours. Your Technical knowledge will be assessed through an experience based intelligence scenario. Interviews will take place face to face at either Manchester regional centre or Leeds regional centre. Sift and interview dates to be confirmed.

Eligibility: Please take extra care to tick the correct boxes in the eligibility sections of your application form. Mistakes sometimes happen but if you contact us later than two working days (Monday-Friday) before the vacancy closes, we may not be able to reopen your application for you. If you do make a mistake with your eligibility form, or have withdrawn yourself in error and need your application reinstated whilst the campaign is still live, please contact us.