> Markdown version of [/jobs/ext/1961167-cybercrime-operational-lead](https://www.wearedevelopers.com/jobs/ext/1961167-cybercrime-operational-lead). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cybercrime Operational Lead - **Company:** HMRC - **Location:** Manchester, UK - **Experience:** Expert - **Salary:** £58,541.0 - **Contract:** Permanent contract - **Skills:** Data Analysis, Digital Forensics, Fraud Prevention and Detection, Internet Services, Open Source Technology, Malware, Cyber Threat Analysis, Cybercrime - **Published:** August 7, 2026 - **Apply:** https://find.jobs/jobs-near-me/apply/ats-redirect/?id=2912393853-2 ## About the Role * Proven success in engaging stakeholders in order to build relationships across government and law enforcement within the UK and internationally. * Proven success in implementing strategy through tactical objectives and delivering measurable outcomes * Strong collaborative skills, with the ability to work dynamically and under pressure with colleagues across investigative and intelligence disciplines to achieve successful outcomes * Clear and confident communication skills, with ability to explain findings, develop investigative rationale and engage effectively with both internal stakeholders and external partners at all levels Successful candidates will need to effectively develop and apply subject matter expertise. This includes * Knowledge of UK cybercrime threats, online criminal marketplaces and enabling cybercrime services, especially activity linked to cashing-out. * Understanding of end-user devices, networks and internet services in the context of cybercrime investigations, * Proven experience of leading operational teams within a law enforcement context. This will be either directing cybercrime or organised crime intelligence or investigation operations, including developing and delivering a range of strategies outcomes. * Expertise in the use of sensitive intelligence powers, assuring and developing knowledge and expertise across others. * Sound knowledge of the legislation that underpins the work of FIS in the criminal justice environment, in particular Regulation of Investigatory Powers Act 2000 (RIPA), Investigatory Powers Act (IPA) 2016, the Police Act 1997, Criminal Procedures and Investigations Act (CPIA) and the Police and Criminal Evidence Act (PACE), Proceeds of Crime Act 2002 (POCA). * Sound understanding of the use of digital evidence and digital intelligence in the context of a criminal investigation Desirable Criteria: * Familiarity with online fraud detection systems in government, financial or the retail sector. * Familiarity with Cyber Threat Intel Analysis, including open-source techniques in relation to cybercrime and attribution. ## Description Discover what it's like to work in a compliance role that makes an impact. Could you help us shape a stronger, fairer future? Your next career move starts here. HMRC's Fraud Investigation Service (FIS) is responsible for the department's civil and criminal investigations. Covert Operations, Digital Exploitation (CODE) sits within FIS. Working across Law Enforcement and government, CODE provides investigative tools and covert techniques to front-line investigations and works with key partners to develop and provide access to new technology and systems to enable investigators to respond to serious and complex tax evasion and crime. The FIS CODE Cybercrime Team tackles evolving cyber threats to HMRC through intelligence, investigations, forensic analysis, and cyber expertise. We provide actionable insight to strengthen systems, improve resilience, and inform countermeasures protecting HMRC's digital services. By gathering critical evidence, intelligence and data, we enable confident decision-making that secures systems used by millions of taxpayers and supports UK public services. Our work also involves disrupting major criminal networks and those who enable them. The Team operates under 3 areas: Strategy & Business Management: Sets and ensures delivery of the team's strategic direction in line with HMRC's wider objectives. Technical Investigation: Uses specialist cyber investigators to carry out digital forensics, data analysis, and malware investigations to identify and develop cybercrime cases and strengthen HMRC's defence. Intelligence, Investigation & Operational Engagement: Deploys cybercrime criminal investigators to use covert and sensitive intelligence capabilities, progress investigations, UK and international partnerships to detect cybercrime threats and respond to online criminal actors targeting HMRC services, data, and customers., This role of Cybercrime Operational Lead will be an additional second post alongside an existing postholder. Together, the Cybercrime Operational Leads will provide joint responsibility to lead the growing Intelligence, Investigation & Operational Engagement area. The role is responsible for HMRC's cybercrime intelligence and investigation strategy, delivering against FIS tactical priorities and directly supporting wider departmental and cross government strategic outcomes. As a Cybercrime Operational Lead, you will be involved in some of the most challenging yet rewarding work within law enforcement. Cybercriminals can be inventive and ingenious with technology, just as you will need to be innovative when using HMRC's wide-ranging legal powers and investigative techniques in response. You will use your investigative skills and cybercrime knowledge to help define, prioritise and delivery the tactical and operational strategies for cybercrime investigations. Critical to your success are your people. Working together with the wider senior management team, you will be focused on maintaining a positive, inclusive, innovative and confident culture across the Cybercrime team. This is against a backdrop of significant and fast-paced change including continued team and capabilities expansion through Spending Review (SR) investment. The FIS Cybercrime Team is located across HMRC's regional centres at Stratford in London, Manchester, Leeds and Nottingham. You will occasionally be required to attend these locations in addition to your home office location and may have to stay overnight. Due to the operational activity conducted by the team, you will occasionally be required to work away from the office in the UK and overseas. Person specification The successful candidate will * Lead intelligence assessment and operations: Ensuring progression of appropriate investigative and disruption opportunities, directing complex, multi-agency and cross-jurisdiction investigations through to completion, working closely with CPS Cyber leads. * Deliver operational outcomes: Oversee safe and effective delivery of operations, in cognisance to strategies and FIS operational plans, pursuing criminal investigations or alternative disruption strategies as appropriate to achieve maximum impact and value from intelligence. * Manage and lead teams: Provide leadership, direction, and operational assurance to cybercrime investigators across multiple locations. * Build strategic partnerships: Develop and maintain effective relationships withing HMRC, UK and international law enforcement, intelligence, and industry partners to represent HMRC and support its cybercrime mission. * Maximise intelligence capabilities: Leverage HMRC and key law enforcement sensitive intelligence capability to direct and access vital insights and intelligence on current and emerging online fraud and cybercrime threats. * Collaborate across CODE Cybercrime functions: Work closely with Cybercrime Technical and Strategy Leads to fully utilise specialist expertise and maximise operational impact. * Capture and apply insight: Ensure knowledge of criminal techniques and HMRC system vulnerabilities is recorded and used to inform departmental risk management and mitigation strategies. ## Related Videos - [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime) - [Hosting a modern justice system](https://www.wearedevelopers.com/videos/332-hosting-a-modern-justice-system) - [Data Science in Retail](https://www.wearedevelopers.com/videos/586-data-science-in-retail) - [Enhancing Workload Security in Kubernetes](https://www.wearedevelopers.com/videos/356-enhancing-workload-security-in-kubernetes) - [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) ## Related Articles - [Data Analyst Salary in the UK](https://www.wearedevelopers.com/magazine/278-data-analyst-salary-in-the-uk) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [IT Salaries in UK](https://www.wearedevelopers.com/magazine/288-it-salaries-in-uk) - [10 Highest Paying Jobs in the UK](https://www.wearedevelopers.com/magazine/257-10-highest-paying-jobs-in-the-uk) - [Data Engineer Salary UK](https://www.wearedevelopers.com/magazine/253-data-engineer-salary-uk) - [UK Business Culture and Etiquette](https://www.wearedevelopers.com/magazine/326-uk-business-culture-and-etiquette)