Officer – Tactical Research & Development

Birmingham, London

For roles based in London, your contractual place of work will be Stratford. While the Stratford site is expected to become operational from November 2025 – March 2026, you will be required to carry out your contractual duties from Vauxhall or another reasonable location on a temporary basis during the interim period.

Please note that, as Stratford will be your contractual place of work, any subsequent move from a temporary location will not entitle you to payments for travel time or costs under the Relocation and Excess Travel Policy.

Job Summary

The National Cyber Crime Unit’s (NCCU) Tactical Research & Development (TR&D) team is a specialist capability within the National Crime Agency (NCA), comprising operational deployment experts and technical developers who support both national and international investigations.

As a member of TR&D you will design, develop and deploy sophisticated covert capabilities and toolsets that directly support and enhance intelligence collection. These capabilities are used in complex investigations into high‑end serious and organised crime (SOC), including Cyber Crime, Child Sexual Exploitation, Firearms, Controlled Drugs and Organised Immigration Crime.

Job Description

As an Officer within TR&D you will work closely with NCA investigative teams, UK policing partners and international law enforcement agencies, providing specialist advice and delivering innovative, niche technical solutions. Typical areas of work include malware analysis, cryptocurrency tracing, incident response, network infrastructure investigations and covert device monitoring.

TR&D is a small, highly collaborative team that values innovation, problem‑solving and teamwork. We are seeking an individual who can thrive in a cooperative environment, can tackle complex challenges creatively, and be able to produce clear, high‑quality written reports to an evidential standard.

In this role, you will have the opportunity to undertake external training courses to support your professional development. These courses can be highly valuable; however, successful candidates will be expected to achieve the required pass standard for all training undertaken.

In addition to external courses, the post-holder must either already hold, or be willing to complete, mandatory training in Personal Protective Safety Training (PPST/OST) and First Aid.

Important Note

Please note that this role may involve exposure to material relating to Child Sexual Exploitation (CSE). Individuals involved in child sexual abuse and exploitation target some of the most vulnerable members of society, and the NCA is committed to preventing and disrupting this criminal activity.

As part of this role, you may be required to work directly or indirectly on investigations that involve exposure to child sexual abuse images and related material. Applicants should carefully consider the sensitive nature of this work and their personal resilience before deciding to apply.

The NCA places a strong emphasis on safeguarding and staff wellbeing. Robust welfare measures are in place, including access to specialist occupational health services, wellbeing support and managerial oversight. Employees working in these areas are supported through structured safeguarding processes, with appropriate guidance, training and opportunities to access additional support when required.

Duties And Responsibilities

Operational Deployment - Deploy in response to time‑critical and active criminal incidents within the UK and internationally, providing specialist technical support to live investigations.

Data Analysis and Intelligence Development -

Analyse and interpret complex data sets to produce targeted intelligence and evidential packages for investigation teams, law enforcement partners and government stakeholders.

Subject Matter Expertise - Develop and maintain specialist knowledge in cyber‑related disciplines, becoming a subject matter expert in areas such as malware, encryption, obfuscation techniques and cryptocurrencies.

Technical Support and Capability Development - Provide advanced technical support and design bespoke technical solutions to support NCCU/NCA investigation teams and UK and international law enforcement partners.

Partnership and Collaboration - Work closely with UK and international partners across government, academia and industry to build effective relationships, share knowledge, develop techniques and establish best practice.

Digital Forensics and Method Development - Contribute to the development, testing and implementation of new digital forensic methods, tools and operational procedures.

Continuous Capability Improvement - Continuously enhance cyber investigation capabilities to ensure the NCA remains effective against emerging technologies, evolving criminal methodologies and new threat landscapes.

As an Officer within TR&D you will work closely with NCA investigative teams, UK policing partners and international law enforcement agencies, providing specialis

t advice and delivering innovative, niche technical solutions. Typical areas of work include malware analysis, cryptocurrency tracing, incident response, network infrastructure investigations and covert device monitoring.

TR&D is a small, highly collaborative team that values innovation, problem‑solving and teamwork. We are seeking an individual who can thrive in a cooperative environment, can tackle complex challenges creatively, and be able to produce clear, high‑quality written reports to an evidential standard.

In this role, you will have the opportunity to undertake external training courses to support your professional development. These courses can be highly valuable; however, successful candidates will be expected to achieve the required pass standard for all training undertaken.

In addition to external courses, the post-holder must either already hold, or be willing to complete, mandatory training in Personal Protective Safety Training (PPST/OST) and First Aid.

Important Note

Please note that this role may involve exposure to material relating to Child Sexual Exploitation (CSE). Individuals involved in child sexual abuse and exploitation target some of the most vulnerable members of society, and the NCA is committed to preventing and disrupting this criminal activity.

As part of this role, you may be required to work directly or indirectly on investigations that involve exposure to child sexual abuse images and related material. Applicants should carefully consider the sensitive nature of this work and their personal resilience before deciding to apply.

The NCA places a strong emphasis on safeguarding and staff wellbeing. Robust welfare measures are in place, including access to specialist occupational health services, wellbeing support and managerial oversight. Employees working in these areas are supported through structured safeguarding processes, with appropriate guidance, training and opportunities to access additional support when required.

Duties And Responsibilities

Operational Deployment - Deploy in response to time‑critical and active criminal incidents within the UK and internationally, providing specialist technical support to live investigations.

Data Analysis and Intelligence Development - Analyse and interpret complex data sets to produce targeted intelligence and evidential packages for investigation teams, law enforcement partners and government stakeholders.

Subject Matter Expertise - Develop and maintain specialist knowledge in cyber‑related disciplines, becoming a subject matter expert in areas such as malware, encryption, obfuscation techniques and cryptocurrencies.

Technical Support and Capability Development - Provide advanced technical support and design bespoke technical solutions to support NCCU/NCA investigation teams and UK and international law enforcement partners.

Partnership and Collaboration - Work closely with UK and international partners across government, academia and industry to build effective relationships, share knowledge, develop techniques and establish best practice.

Digital Forensics and Method Development -

Contribute to the development, testing and implementation of new digital forensic methods, tools and operational procedures.

Continuous Capability Improvement - Continuously enhance cyber investigation capabilities to ensure the NCA remains effective against emerging technologies, evolving criminal methodologies and new threat landscapes.

Person specification

Report Writing and Communication - Strong report writing and drafting skills, with the ability to produce clear, concise and accurate written material for investigative and evidential purposes.

IT Literacy - Proficient in the use of Microsoft Office applications, including Word, Excel, PowerPoint and Outlook.

Specialist Cyber Capability - Willingness and ability to develop specialist technical skills and progress towards subject matter expertise in cyber‑related areas such as malware, encryption, obfuscation techniques and cryptocurrencies.

Case and Information Management - Experience of managing case material in accordance with NCA policies and procedures, the Code of Ethics and relevant information management standards.

Cyber and Threat Awareness -

A sound understanding of how emerging technologies create opportunities for offenders, including the associated risks to children and vulnerable persons.

Legislative Knowledge - In‑depth knowledge and practical application of relevant UK and international legislation impacting law‑enforcement activity.

Digital Forensics Knowledge - Knowledge of digital forensic principles, including the handling of data in a forensically sound manner. Understanding of forensic tools and methods used to process data and present findings clearly to a range of audiences.

Networking Knowledge - Knowledge of computer networking fundamentals, including networking layers, data transmission from source to destination, and methods for capturing and analysing network traffic.

Operating Systems, Software and Coding Expertise - In‑depth knowledge of Windows and comparable operating systems, with the ability to identify, locate and extract data of evidential value for law‑enforcement purposes. Advanced understanding of operating system and software environments, including Linux file systems and the Windows Registry. Experience using command‑line utilities such as Terminal and PowerShell. Working knowledge of coding and scripting languages, such as Python and Bash, to support analysis, automation and investigative activity.

Technical Experience and Qualifications -

Proven experience and/or relevant qualifications in one or more of the following areas: Digital forensics; Penetration testing; Reverse engineering; Malware analysis.

Networking Technologies - Experience with networking technologies, including TCP/IP and DNS, and practical experience capturing, configuring and analysing network traffic.

Operational and Project Delivery - Demonstrable experience of managing operational or project delivery within time‑critical environments, delivering outputs to required standards and deadlines.

Desirable Criteria (to be used in the event of a tie-break)

A recognised technical or scientific qualification with a focus on computer science, cyber security, networking or closely related fields.

Behaviours

We'll assess you against these behaviours during the selection process:

• Making Effective Decisions
• Working Together
  
  

Technical skills

We'll assess you against these technical skills during the selection process:

• Working knowledge of coding (e.g. Python) and/or scripting languages (e.g. Bash). [Lead Criteria]

Proven experience and/or relevant qualifications in one or more of the following areas: digital forensics, penetration testing, reverse engineering or malware analysis.

Demonstrable experience and in‑depth knowledge of both Linux and Windows operating systems.

Experience of core internet technologies, such as TCP/IP and DNS, together with an understanding of new and emerging technologies (e.g. cryptocurrencies) and their potential positive or negative impact on law‑enforcement activity.

Alongside your salary of £36,057, National Crime Agency contributes £10,445 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides.

New entrants to the NCA receive 26 days annual leave, rising to 31 on completion of 5 years continuous service, plus 8 bank holidays.

If qualifying criteria is met new joiners from UK Police Forces or the UK Intelligence Community (UKIC) will have service with those employers taken into account for continuous service purposes for annual leave entitlement only, this will be up to a maximum of 31 days leave (including 1 privilege day).

Other Benefits Include:

• Flexible working, including flexi-time, compressed hours and job sharing (in line with business requirements)
• Family friendly policies, notably above the statutory minimum
• Learning and Development opportunities
• Interest free loans and advances, including season tickets, childcare and rental deposits
• Housing schemes - Key Worker status
• Discounts and Savings with a wide variety of services including Cycle to Work, Smart Tech schemes, dental insurance, gym discounts and savings on everyday spending, available through the Reward Gateway , Edenred and Blue Light Card schemes.
• Staff support groups/networks
• Sports and social activities, including membership to the Civil Service Sports Council (CSSC)
  
  

Further information is available on the NCA Website.

Artificial intelligence

Artificial intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action. Please see our candidate guidance (opens in a new window) for more information on appropriate and inappropriate use.

Selection process details

This vacancy is using Success Profiles (opens in a new window), and will assess your Behaviours, Experience and Technical skills.

We'll assess you against these behaviours during the selection process:

• Making Effective Decisions

Working Together

Technical Skills And Experience

We'll assess you against these technical skills and experience during the selection process:

• Working knowledge of coding (e.g. Python) and/or scripting languages (e.g. Bash). [Lead Criteria]
• Proven experience and/or relevant qualifications in one or more of the following areas: digital forensics, penetration testing, reverse engineering or malware analysis.
• Demonstrable experience and in‑depth knowledge of both Linux and Windows operating systems.
• Experience of core internet technologies, such as TCP/IP and DNS, together with an understanding of new and emerging technologies (e.g. cryptocurrencies) and their potential positive or negative impact on law‑enforcement activity.
  
  

Full advert details for this vacancy can found on the advert on the NCA Recruitment Portal. Please follow the link to apply at advertisers' site.

Feedback will only be provided if you attend an interview or assessment.

This vacancy is using Success Profiles (opens in a new window), and will assess your Behaviours, Experience and Technical skills.

Security

Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check (opens in a new window).See our vetting charter (opens in a new window).

People working with government assets must complete baseline personnel security standard (opens in new window) checks.

Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check (opens in a new window).See our vetting charter (opens in a new window).

People working with government assets must complete baseline personnel security standard (opens in new window) checks.

Medical

Successful candidates will be expected to have a medical.

Nationality requirements

This Job Is Broadly Open To The Following Groups:

• UK nationals
• nationals of the Republic of Ireland
• nationals of Commonwealth countries who have the right to work in the UK
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS) (opens in a new window)
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
• individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
• Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service
  
  

Further information on nationality requirements (opens in a new window)

Working for the Civil Service

The Civil Service Code (opens in a new window) sets out the standards of behaviour expected of civil servants.

We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window).

The Civil Service embraces diversity and promotes equal opportunities. As such, we run a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.

The Civil Service also offers a Redeployment Interview Scheme to civil servants who are at risk of redundancy, and who meet the minimum requirements for the advertised vacancy.

The Civil Service Code (opens in a new window) sets out the standards of behaviour expected of civil servants.

We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window).

The Civil Service embraces diversity and promotes equal opportunities. As such, we run a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.

The Civil Service also offers a Redeployment Interview Scheme to civil servants who are at risk of redundancy, and who meet the minimum requirements for the advertised vacancy.

Diversity and Inclusion

The Civil Service is committed to attract, retain and invest in talent wherever it is found. To learn more please see the Civil Service People Plan (opens in a new window) and the Civil Service Diversity and Inclusion Strategy (opens in a new window).

This vacancy is part of the Great Place to Work for Veterans (opens in a new window) initiative.

Once this job has closed, the job advert will no longer be available. You may want to save a copy for your records.

Contact point for applicants

Job Contact :

• Name : central.recruitment@nca.gov.uk
• Email : central.recruitment@nca.gov.uk
• Telephone : central.recruitment@nca.gov.uk
  
  

Recruitment team

• Email : central.recruitment@nca.gov.uk
  
  

Further information

If you believe your application has not been treated fairly, email: Central.Recruitment@nca.gov.uk (quoting the vacancy reference).

If unresolved, you may escalate your complaint to the Civil Service Commission.