HM Revenue & Customs
Cybercrime Operational Lead

How your CV stacks up
Upload your CV to see how well it fits this job role
?%
About The Job
Job Summary
Discover what it's like to work in a compliance role that makes an impact. Could you help us shape a stronger, fairer future? Your next career move starts here.
HMRC's Fraud Investigation Service (FIS) is responsible for the department's civil and criminal investigations.
Covert Operations, Digital Exploitation (CODE) sits within FIS. Working across Law Enforcement and government, CODE provides investigative tools and covert techniques to front-line investigations and works with key partners to develop and provide access to new technology and systems to enable investigators to respond to serious and complex tax evasion and crime.
The FIS CODE Cybercrime Team tackles evolving cyber threats to HMRC through intelligence, investigations, forensic analysis, and cyber expertise. We provide actionable insight to strengthen systems, improve resilience, and inform countermeasures protecting HMRC's digital services. By gathering critical evidence, intelligence and data, we enable confident decision-making that secures systems used by millions of taxpayers and supports UK public services. Our work also involves disrupting major criminal networks and those who enable them.
The Team Operates Under 3 Areas
- Strategy & Business Management: Sets and ensures delivery of the team's strategic direction in line with HMRC's wider objectives.
- Technical Investigation: Uses specialist cyber investigators to carry out digital forensics, data analysis, and malware investigations to identify and develop cybercrime cases and strengthen HMRC's defence.
- Intelligence, Investigation & Operational Engagement: Deploys cybercrime criminal investigators to use covert and sensitive intelligence capabilities, progress investigations, UK and international partnerships to detect cybercrime threats and respond to online criminal actors targeting HMRC services, data, and customers.
For more information about our Directorates, Lines of Business and some of our roles, please visit the FIS Careers pages https://www.civil-service-careers.gov.uk/hmrc-fraud-investigation-service/.
Job Description
This role of Cybercrime Operational Lead will be an additional second post alongside an existing postholder. Together, the Cybercrime Operational Leads will provide joint responsibility to lead the growing Intelligence, Investigation & Operational Engagement area.
The role is responsible for HMRC's cybercrime intelligence and investigation strategy, delivering against FIS tactical priorities and directly supporting wider departmental and cross government strategic outcomes.
As a Cybercrime Operational Lead, you will be involved in some of the most challenging yet rewarding work within law enforcement.
Cybercriminals can be inventive and ingenious with technology, just as you will need to be innovative when using HMRC's wide-ranging legal powers and investigative techniques in response. You will use your investigative skills and cybercrime knowledge to help define, prioritise and delivery the tactical and operational strategies for cybercrime investigations.
Critical to your success are your people. Working together with the wider senior management team, you will be focused on maintaining a positive, inclusive, innovative and confident culture across the Cybercrime team. This is against a backdrop of significant and fast-paced change including continued team and capabilities expansion through Spending Review (SR) investment.
The FIS Cybercrime Team is located across HMRC's regional centres at Stratford in London, Manchester, Leeds and Nottingham. You will occasionally be required to attend these locations in addition to your home office location and may have to stay overnight. Due to the operational activity conducted by the team, you will occasionally be required to work away from the office in the UK and overseas.
Reasons to use Rodeo
I’m in my final year doing Economics and I don’t know whether to apply for grad schemes now or do a masters first. What do you think?
Honest answer — it depends on where you want to end up. A lot of top grad schemes (Big 4, civil service, banking) don’t need a masters. Let’s look at the ones you’d be competitive for now, and we can decide if a masters actually adds anything.
Also worth knowing: most autumn 2026 applications are open now. Timing matters more than you think.
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
Graduate Consultant — 2026 Scheme
Why you're a good match
StrongYour economics background and your summer at a regional bank line up with what PwC looks for on the consulting scheme. Applications close in four weeks.
See breakdownIt searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Why you're a good match
You’ve got the grades and the economics background, and your bank internship is exactly the experience this scheme looks for. Apply soon — deadlines close within the month.
Experience fit
Your summer at the bank plus your econometrics coursework map directly to the day-one responsibilities on this scheme — client modelling, market briefings, and deal support.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Person Specification
The successful candidate will
- Lead intelligence assessment and operations: Ensuring progression of appropriate investigative and disruption opportunities, directing complex, multi-agency and cross-jurisdiction investigations through to completion, working closely with CPS Cyber leads.
- Deliver operational outcomes: Oversee safe and effective delivery of operations, in cognisance to strategies and FIS operational plans, pursuing criminal investigations or alternative disruption strategies as appropriate to achieve maximum impact and value from intelligence.
- Manage and lead teams: Provide leadership, direction, and operational assurance to cybercrime investigators across multiple locations.
- Build strategic partnerships: Develop and maintain effective relationships withing HMRC, UK and international law enforcement, intelligence, and industry partners to represent HMRC and support its cybercrime mission.
- Maximise intelligence capabilities: Leverage HMRC and key law enforcement sensitive intelligence capability to direct and access vital insights and intelligence on current and emerging online fraud and cybercrime threats.
- Collaborate across CODE Cybercrime functions: Work closely with Cybercrime Technical and Strategy Leads to fully utilise specialist expertise and maximise operational impact.
- Capture and apply insight: Ensure knowledge of criminal techniques and HMRC system vulnerabilities is recorded and used to inform departmental risk management and mitigation strategies.
In order to undertake these key responsibilities, we are seeking candidates who have
- Proven success in engaging stakeholders in order to build relationships across government and law enforcement within the UK and internationally.
- Proven success in implementing strategy through tactical objectives and delivering measurable outcomes
- Strong collaborative skills, with the ability to work dynamically and under pressure with colleagues across investigative and intelligence disciplines to achieve successful outcomes
- Clear and confident communication skills, with ability to explain findings, develop investigative rationale and engage effectively with both internal stakeholders and external partners at all levels
Successful candidates will need to effectively develop and apply subject matter expertise. This includes
- Knowledge of UK cybercrime threats, online criminal marketplaces and enabling cybercrime services, especially activity linked to cashing-out.
- Understanding of end-user devices, networks and internet services in the context of cybercrime investigations
Additional Security Information
In addition to the standard pre-employment checks for appointment into the Civil Service, all candidates must also obtain National Security Vetting at Security Check (SC) clearance level for this vacancy. You will normally need to meet the minimum UK residency period as determined by the level of vetting being undertaken, which for SC is 5 years UK residency prior to your vetting application. Once in post you will be required to apply for Developed Vetting (DV) clearance which has a requirement for 10 years UK residency. If you have any questions about this residency requirement, please speak to the vacancy holder for this post. This post is open to 'UK Nationals Only'.
CODE have a support network that can offer assistance to colleagues throughout the DV process. CODE understands the experience of obtaining DV clearance affects individuals differently with the process being in depth and intrusive. The network consists of CODE DV cleared volunteers who will be able to guide you through the process and systems and look to alleviate any concerns.


Get help with your application
Your very own career expert that helps elevate your application to the next level.
Essential Criteria
- Proven experience of leading operational teams within a law enforcement context. This will be either directing cybercrime or organised crime intelligence or investigation operations, including developing and delivering a range of strategies outcomes.
- Expertise in the use of sensitive intelligence powers, assuring and developing knowledge and expertise across others.
- Sound knowledge of the legislation that underpins the work of FIS in the criminal justice environment, in particular Regulation of Investigatory Powers Act 2000 (RIPA), Investigatory Powers Act (IPA) 2016, the Police Act 1997, Criminal Procedures and Investigations Act (CPIA) and the Police and Criminal Evidence Act (PACE), Proceeds of Crime Act 2002 (POCA).
- Sound understanding of the use of digital evidence and digital intelligence in the context of a criminal investigation
Desirable Criteria
- Familiarity with online fraud detection systems in government, financial or the retail sector.
- Familiarity with Cyber Threat Intel Analysis, including open-source techniques in relation to cybercrime and attribution.
Further Location Information
Please ensure that you only apply for a location that you are willing and able to work from, as we will only make one offer of employment. Any additional notes included in a 'Further Location Preferences (optional)' field within the application form, will not be considered. Please be aware that you cannot change your location preference after submitting your application.
Behaviours
We'll assess you against these behaviours during the selection process:
- Leadership
- Seeing the Big Picture
- Delivering at Pace
Benefits
Alongside your salary of £58,541, HM Revenue and Customs contributes £16,959 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides (opens in a new window).
HMRC operates both Flexible and Hybrid Working policies, allowing you to balance your work and personal commitments. We welcome applications from those who need to work a more flexible arrangement and will agree to requests where possible, considering our operational and customer service needs.
We offer a generous leave allowance, starting at 25 days and increasing by a day for every year of qualifying service up to a maximum of 30 days.
- Pension - We make contributions to our colleagues' Alpha pension equal to at least 28.97% of their salary.
- Family friendly policies.
- Personal support.
- Coaching and development.
To find out more about HMRC benefits and find out what it's really like to work for HMRC hear from our insiders or visit Thinking of joining the Civil Service.
This post attracts a Level 1b Flexibility Payment (FP) that is paid monthly with salary. This FP requires you to undertake periods of On Call. You will be expected to work On Call 1 week in 4.
In applying for a position and accepting the FP you agree that you can and will meet those attendance requirements.
FP levels are reviewed annually - on a business need and personal basis - and may be subject to change.
Details of the Flexibility Payment can be found in the attached document.
Things you need to know
Artificial intelligence
Artificial intelligence can be a useful tool to support your application, however, all examples
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Location