Connecting Talent to opportunity

Connecting Talent to opportunity

Cybercrime Investigator – Operational Engagement Officer


Job Description:

Summary At HMRC we are committed to creating a great place to work for all our colleagues; an inclusive and respectful environment that reflects the diversity of the society we serve.

We want to maximise the potential of everyone who chooses to work for us and we offer a range of flexible working patterns and support to make a fulfilling career at HMRC accessible to you.

Diverse perspectives and experiences are critical to our success and we welcome applications from all people from all backgrounds with the experience and skills needed to perform this role.

HMRC is the UK’s tax, payments and customs authority and we have a vital purpose: we collect the money that pays for the UK’s public services and help families and individuals with targeted financial support.

Digital Support and Innovation (DSI) sits within HMRC’s wider Fraud Investigation Service (FIS) responsible for the department’s civil and criminal investigation work. FIS ensures that HMRC has an effective approach to taking on the most serious tax evasion and fraud.

Working across Law Enforcement and government, DSI provides investigative tools and covert techniques to front-line investigations and works with key partners to develop and provide access to new technology and systems to enable investigators to respond to serious and complex tax evasion and crime. Responsibilities You will be the Cybercrime team’s lead on engagement with various law enforcement intelligence and operational teams engaged with Cybercrime and money laundering investigation. As a Cybercrime investigator you will support our joint operations with partner agencies, providing insight from our investigations, identifying intelligence and evidence gathering opportunities to progress investigations and plan interdictions. You will at times be required to deploy operationally with HMRC and Policing investigators to support these interventions.

For the first 6 months you will work with the Cybercrime team at Stratford Regional Centre building your skills and experience in the cybercrime teams capabilities and methodologies, you will lead investigations and support a wide range of teams within HMRC and across government in mitigating the risk from Cybercrime.

On acquiring the necessary security clearance and accreditation required by partners, you will work from their offices for the majority of the working week. There will be a requirement to attend meetings at Stratford Regional Centre regularly on a pre-planned or dynamic basis.

You will need to be flexible, motivated and have a thirst for learning. Cybercriminals can be inventive and ingenious with technology, just as you will need to be innovative when using HMRC’s wide-ranging legal powers and investigative techniques in response.

You will liaise with internal and external intelligence and investigation partners in response to threats they identify. This will include teams across HMRC, wider government and law enforcement partners both in the UK (police forces, ROCUs and the NCA) and internationally. You will use your cybercrime skills to support investigations, which may include conducting searches of premises as well as preparing and conducting suspect interviews.

You will be engaged with sensitive intelligence sources to develop intelligence and start investigations. The nature of these investigations requires dynamic collaboration in real time utilising a wide range of techniques in digital pursuit of those attacking our services, including:

• Interrogation of departmental information systems;

• Analysis of transactional data on HMRC online services to identify lines of enquiry;

• Exploitation of Open Source and Digital investigation techniques;

• Analysis of financial intelligence and developing financial investigation strategies, including crypto-asset tracing;

• Analysis and exploitation of communications data to identify lines of enquiry;

• Obtaining a full range of surveillance and data acquisition authorities where appropriate.

Essential Criteria:

The successful candidate must:

• Have demonstrable experience in investigation of online crime and working with sensitive intelligence.

• Have practical operational experience working with digital evidence and intelligence from financial, communication and internet service providers to identify lines of enquiry.

• Demonstrate knowledge of the application and use of covert surveillance and communications data acquisition authorities, handling intelligence at different classifications, and the subsequent analysis and presentation of the information and evidence obtained.

You must also meet one of the following:

• BTEC Level 4 Advanced Diploma in Counter Fraud

• Level 3 Advanced Diploma in Criminal Investigation

• Accredited Counter Fraud Specialist (ACFS) / Accredited Counter Fraud Intelligence Specialist (ACFIS)

• Satisfactory completion of any Specialist Trial Period (STP) or Trial Assessment Period (TAP) within current post.


• Be able to demonstrate sound knowledge of the legislation that underpins the work of FIS in the criminal justice environment, in particular Regulation of Investigatory Powers Act 2000 (RIPA), Investigatory Powers Act (IPA) 2016, the Police Act 1997, Criminal Procedures and Investigations Act (CPIA) and the Police and Criminal Evidence Act (PACE), Proceeds of Crime Act 2002 (POCA).

• Currently hold National Security Vetting at Security Check (SC) clearance level and be willing to apply for and be able to achieve Developed Vetting (DV) clearance level to continue in the role.

Further information regarding security vetting can be found in the following link;

Desirable criteria:

• Be able to demonstrate an understanding of UK cybercrime threats, online criminal marketplaces and enabling cybercrime services, especially cash-out.

• Experience in online fraud detection systems in government, financial or the retail sector.

• Knowledge of Eastern European languages, such as Russian, Ukrainian or Romanian.

• A full driving licence.