Cybercrime Investigator London, England
Job description
Details
Reference number
Salary
Job grade
Contract type
Business area
Type of role
Working pattern
Number of jobs available
Contents
Location
About the job
Benefits
Things you need to know
Apply and further information
Location
About the job
Job summary
HMRC is the UK’s tax, payments and customs authority and we have a vital purpose: we collect the money that pays for the UK’s public services and help families and individuals with targeted financial support.
Digital Support and Innovation (DSI) sits within HMRC’s wider Fraud Investigation Service (FIS) responsible for the department’s civil and criminal investigation work. FIS ensures that HMRC has an effective approach to taking on the most serious tax evasion and fraud.
Working across Law Enforcement and government, DSI provides investigative tools and covert techniques to front-line investigations and works with key partners to develop and provide access to new technology and systems to enable investigators to respond to serious and complex tax evasion and crime.
See what it’s like to work at HMRC: find out more about us or ask our colleagues a question. Questions relating to an individual application must be emailed as detailed later in this advert.
Job description
The Cybercrime Team is responsible for tackling the ever-changing cybercrime threats to HMRC by both leading criminal investigations against individuals and identifying new ways to protect and increase resilience of our online services. You will learn every day, be constantly challenged, and enjoy the thrill of the digital pursuit of sophisticated adversaries.
Cybercrime investigation involves a range of investigative techniques being deployed in real time to identify attacks and adversaries. These include conventional intelligence and investigative methodologies as well as sophisticated technical data and forensic analysis.
Person specification
As a Cybercrime investigator, you will be involved in some of the most challenging yet rewarding work within law enforcement. You will be engaged with sensitive intelligence sources to identify online fraud and cybercrime threats to HMRC; identifying evidence gathering opportunities and planning interdictions.
You will liaise with internal and external intelligence and investigation partners in response to threats they identify. This will include teams across HMRC, wider government and law enforcement partners both in the UK (police forces, ROCUs and the NCA) and internationally.
You will use your investigative skills and cybercrime knowledge to support investigations and, at times, deploy operationally with HMRC and law enforcement partners to support interventions, which may include conducting searches of premises as well as preparing and conducting suspect interviews.
The nature of these investigations requires dynamic collaboration in real time utilising a wide range of techniques in digital pursuit of those attacking our services, including:
- Interrogation of departmental information systems
- Analysis of transactional data on HMRC online services to identify lines of enquiry
- Exploitation of Open Source and Digital investigation techniques
- Analysis of financial intelligence and developing financial investigation strategies, including crypto-asset tracing
- Analysis and exploitation of communications data to identify lines of enquiry
- Obtaining a full range of surveillance and data acquisition authorities where appropriate
- Support visits to HMRC customers who may have been victims to sophisticated cybercrime attacks, where you will work with forensic practitioners to gather digital evidence
You will need to be flexible, motivated and have a thirst for learning. Cybercriminals can be inventive and ingenious with technology, just as you will need to be innovative when using HMRC’s wide-ranging legal powers and investigative techniques in response.
Essential Criteria
You must:
- Have demonstrable experience in investigation of online crime and working with sensitive intelligence
- Have practical operational experience working with digital evidence and intelligence from financial, communication and internet service providers to identify lines of enquiry
- Demonstrate knowledge of the application and use of covert surveillance and communications data acquisition authorities, handling intelligence at different classifications, and the subsequent analysis and presentation of the information and evidence obtained
You must also meet one of the following:
- BTEC Level 4 Advanced Diploma in Counter Fraud
- Level 3 Advanced Diploma in Criminal Investigation
- Accredited Counter Fraud Specialist (ACFS) / Accredited Counter Fraud Intelligence Specialist (ACFIS)
- Satisfactory completion of any Specialist Trial Period (STP) or Trial Assessment Period (TAP) within current post
- PIP level 2
Or
- Be able demonstrate sound knowledge of the legislation that underpins the work of FIS in the criminal justice environment, in particular Regulation of Investigatory Powers Act 2000 (RIPA), Investigatory Powers Act (IPA) 2016, the Police Act 1997, Criminal Procedures and Investigations Act (CPIA) and the Police and Criminal Evidence Act (PACE), Proceeds of Crime Act 2002 (POCA)
- Currently hold National Security Vetting at Security Check (SC) clearance level and be willing to apply for and be able to achieve Developed Vetting (DV) clearance level to continue in the role
Desirable Criteria
- Be able to demonstrate an understanding of UK cybercrime threats, online criminal marketplaces and enabling cybercrime services, especially cash-out
- Experience in online fraud detection systems in government, financial or the retail sector
- Familiarity with Cyber Threat Intel Analysis, including open-source techniques in relation to cybercrime and attribution
- Knowledge of Eastern European languages, such as Russian, Ukrainian or Romanian
- A full driving licence
Qualifications
- BTEC Level 4 Advanced Diploma in Counter Fraud
- Level 3 Advanced Diploma in Criminal Investigation
- Accredited Counter Fraud Specialist (ACFS) / Accredited Counter Fraud Intelligence Specialist (ACFIS)
- Satisfactory completion of any Specialist Trial Period (STP) or Trial Assessment Period (TAP) within current post.
- PIP level 2
- Be able demonstrate sound knowledge of the legislation that underpins the work of FIS in the criminal justice environment, in particular Regulation of Investigatory Powers Act 2000 (RIPA), Investigatory Powers Act (IPA) 2016, the Police Act 1997, Criminal Procedures and Investigations Act (CPIA) and the Police and Criminal Evidence Act (PACE), Proceeds of Crime Act 2002 (POCA).
Behaviours
We'll assess you against these behaviours during the selection process:
- Communicating and Influencing
- Delivering at Pace
- Seeing the Big Picture
We only ask for evidence of these behaviours on your application form:
- Communicating and Influencing
- Delivering at Pace
Technical skills
We'll assess you against these technical skills during the selection process:
- Candidates will be required to undertake a practical assessment. You will be provided with an intelligence scenario and asked to devise and present an operational plan based on the intelligence.
Benefits
- Interesting and exciting work using a full range of technical and legal tools to tackle cybercrime impacting HMRC, and directly influence the security of the nation’s tax services
- Extensive training package - access to learning and development tailored to your role
- An environment with flexible working options
- A culture encouraging inclusion and diversity
- A Civil Service pension with an average employer contribution of 27%
Flexibility Payment:
This post attracts a Level 2 Flexibility Payment (FP) that is paid monthly with salary. This FP allows HMRC flexibility to change your work pattern, at short notice, to meet business needs. You will be expected to undertake periods of On Call. You will also be expected to work additional hours, at weekends and outside your normal working hours/days (including bank holidays).
In applying for a position and accepting the FP you agree that you can and will meet those attendance requirements.
FP levels are reviewed annually – on a business need and personal basis – and may be subject to change.
If you currently receive the Flexibility Payment, which may include Transition Protection and/or a Maintained Pension Value, moving to a new role may affect your payments.
Find more about HMRC benefits in 'Your little extras and big benefits handbook' for further information or visit Thinking of joining the Civil Service.
Things you need to know
Selection process details
As part of the application process you will be asked to complete a CV and Personal Statement. Further details around what this will entail are listed on the application form.
CV - Please complete the qualifications, career history and skills/experience (max 250 words per section).
Personal Statement – In no more than 750 words please include an example of seeing the big picture on a cybercrime or digital-evidence based investigation. Please also provide examples of how you consider your technical and personal skills, qualities and experience define your suitability for the role against the job description and essential criteria.
You will also be asked to provide separate 250 word statements against the behaviours;
- Communicating and Influencing
- Delivering at Pace
The CV, personal statement and behaviour statements will be assessed at sift.
Candidates who are successful at sift will be selected for interview and further tested against Experience, Technical skills and the Behaviours; Communicating and Influencing, Delivering at Pace and Seeing the Big Picture. You will also be required to undertake a practical assessment. You will be provided with an intelligence scenario and asked to devise and present an operational plan based on the intelligence.
We reserve the right to raise the score required at any stage of the process in order to manage numbers.
Sift and Interview will take place within 5 weeks of advert closing date.
The interview will be face-to-face – location to be confirmed.
Interview dates to be confirmed.
Training
You will be required to undertake the following training once in post;
- HMRC Counter Fraud Criminal Investigation Foundation level 2, if not held.
- Cybercrime foundation training up to advanced practitioner and Cybersecurity essentials training within the first 18 months.
- Advanced OSINT
- Crypto asset tracing
The role requires job holders to successfully complete a twelve-month Training and Assessment Period (TAP).
You will be expected to undertake Operational Safety Training - please see attached document
A reserve list may be held for a period of up to 12 months from which further appointments may be made for the same or similar roles – if this applies to you, we’ll let you know via your Civil Service Jobs account.
Eligibility
To check that you are eligible to apply, review this eligibility information
Important information for existing HMRC contractual homeworkers:
This role may be suitable for existing HMRC employees who are contractual homeworkers. Occasional attendance to the office will be required where there is a business need, so please review the advertised office locations for this role when applying and only select locations from the ‘location preferences’ section that you are able to travel to.
Reasonable Adjustments
We want to make sure no one is put at a disadvantage during our recruitment process because of a disability, condition, or impairment. To assist you with this, we will reduce or remove any barriers where possible and provide additional support where appropriate.
If you need a reasonable adjustment or a change to be made so that you can make your application, review this information on reasonable adjustments, and contact [email protected] as soon as possible.
Equality and Diversity
We’re committed to creating a great place to work for all our colleagues here at HMRC. We want everyone to feel valued, supported and comfortable being their true self at work.
We’re proud to be a diverse and inclusive employer, supporting social mobility by giving opportunities to people from all walks of life. We want to maximise the potential of everyone who chooses to work for us and offer a range of flexible working patterns and support. Our aim is to make a fulfilling career at HMRC accessible to you.
For more information on how we make this happen, review this information on our culture and values.
Applications received from candidates with a criminal record are considered fairly in accordance with the DBS Code of Practice and the Recruitment of ex-offenders Policy.
We welcome applications from those who need to work a more flexible arrangement and will agree to requests where possible after considering operational and customer service needs. We can’t guarantee that we can meet all requests to work flexibly, as agreement will be subject to business ability to accommodate, and any request to work a more flexible arrangement should be made prior to your acceptance of the provisional offer.
Customer facing roles in HMRC require the ability to converse at ease with members of the public and provide advice in accurate spoken English and/or Welsh where required. Where this is an essential requirement, this will be tested as part of the selection process.
The Civil Service runs a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.
The Civil Service also offers a Redeployment Interview Scheme to civil servants who are at risk of redundancy, and who meet the minimum requirements for the advertised vacancy.
Locations
HMRC has a presence in every region of the UK. For more information on where you might be working, review this information on our locations.
Security Update
For more information on the level of security checks we will carry out, review this information on security checks
Please note: in addition to the standard pre-employment checks for appointment into the Civil Service, all candidates must also obtain National Security Vetting at Developed Vetting (DV) clearance level for this vacancy. You will normally need to meet the minimum UK residency period as determined by the level of vetting being undertaken, which for DV is 10 years UK residency prior to your vetting application. If you have any questions about this residency requirement, please speak to the vacancy holder for this post.
Further Information
The Civil Service values honesty and integrity and expects all candidates to abide by these principles. The evidence you provide in your application must relate to your own experiences.
Any instances of plagiarism or other forms of cheating will be investigated and, if proven, the relevant application/s will be withdrawn from the process.
Duplicate applications for the same vacancy will also be withdrawn.
Transferring into HMRC from Civil Service If you are currently working for an ‘Other Government Department’ (OGD) and would like to consider the impact on your pay when joining HMRC, please see the attached document "Combined T&C and OGD Pay English”, found at the bottom of this advert. Further information on staff transfers can be found on gov.uk
Problems during the application process
If you experience accessibility problems with any attachments on this advert, please contact the email address in the 'Contact point for applicants' section.
If you think you’ve made a mistake on a submitted application (e.g. you’ve ticked the incorrect eligibility box), please contact [email protected] at least two working days before the vacancy closes. After this, we won’t be able to reopen your application.
Please use the subject line to insert appropriate wording e.g. Please re-open my application - 286680 & vacancy closing date 26/05/2023.
For reasonable adjustments queries or requests, please see details within reasonable adjustments section above.
Feedback will only be provided if you attend an interview or assessment.
Security
See our vetting charter (opens in a new window).
Nationality requirements
Working for the Civil Service
We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window).
Apply and further information
Contact point for applicants
Job contact :
Recruitment team
Further information
Attachments
