Job summary

Discover a career in your hands at HMRC. Whether you're seeking purpose, growth, or a workplace that gives you a true sense of belonging, hear from some of our employees as they share their story about what it’s really like to work at HMRC.

Visit our YouTube channel to watch the full series and come and discover your potential.

The Fraud Prevention Centre (FPC) in HMRC Security is a growing area, focusing on countering fraud across HMRC services and providing secure Identity and Access Management services for customers. Our mission is to protect our customers and their online accounts from malicious actors, providing a high-quality customer service and support.

Our team is rapidly growing as we invest in new technologies and capabilities, and we are in search of enthusiastic individuals who can help us in achieving our mission.

We are continually improving the service we give to our customers and in line with this we are creating a new response and management team within the HMRC Fraud Prevention Centre.

Job description

Join HMRC’s Fraud Prevention Centre and lead the fight against online fraud. We’re looking for a Fraud Proactive Protection Lead (Grade 7) to spearhead fraud detection and response across HMRC’s digital services. This is a high-impact leadership role where you’ll drive proactive strategies to identify, disrupt, and prevent fraudulent activity at scale. You’ll oversee digital profiling of user interactions, manage complex risk rules to automate interventions, and lead investigations into anomalies and suspicious behaviours.

Working at the heart of HMRC’s transformation, you’ll be ensuring the effective exploitation of our growing range of technical capabilities, including advanced analytics, fraud detection and behavioural analytics, and threat intelligence with big data and SIEM platforms like Splunk, enabling real-time interventions and data-driven decisions. You’ll also collaborate with FPC Customer Operations, compliance teams in Risk, Intelligence and Fraud Investigation, and cyber security specialists to deliver joined-up fraud prevention and incident response. Your work will directly protect millions of taxpayers, safeguard public funds, and strengthen HMRC’s digital resilience against evolving threats to identity and access services.

Information session

HMRC are hosting an information session on Monday 22nd of June at 11am to accompany the application process where you will be able to hear more about the vacancy . You'll also be able to find out more about HMRC from the people who currently work in the role, including:

Who we are
What we do
Why we do it

There will also be the opportunity to ask any questions you may have about the role or the application process.

To join the session, you will need to register by completing the following:

https://forms.cloud.microsoft/e/hMCkMqdfHb

Person specification

Lead and develop teams of security and fraud analysts by example, driving excellence in proactive fraud prevention, detection and response across all customer communications channels.
Design and manage risk rules to identify suspicious patterns and behaviours across HMRC’s digital services, partnering with HMRC Compliance & Customer teams.
Conduct digital profiling of suspect interactions, leveraging intelligence, behavioural analytics to drive response activity and develop automated interventions.
Investigate anomalies and suspicious activity, applying intelligence-led approaches to disrupt fraudulent behaviour or influence customer compliance.
Work closely with FPC Threat Intelligence to understand threats and their scope and scale, FPC Engineering to inform controls, and FPC Performance on reporting.
Partner with wider HMRC compliance teams, including Risk, Intelligence, and Fraud Investigation, to share insights and coordinate fraud disruption strategies.
Analyse large-scale datasets using tools like Splunk, applying advanced techniques and developing tools and dashboards to support efficient action by junior analysts.
Integrate threat intelligence and data enrichment services (e.g., email, phone reputation) into detection workflows.
Work closely with FPC Customer Operations teams to investigate suspicious activity linked to customer reporting and ensure timely resolution.
Support incident management investigations, providing technical expertise and analysis to inform response actions and track them to conclusion.
Drive continuous improvement through automation, intelligence sharing, and feedback loops across FPC and partner teams.
Build strong partnerships across FPC and HMRC (including our Customer Compliance teams, tax and customs service leads) and with external bodies to ensure a coordinated approach to fraud prevention.
Support innovation and continuous improvement in fraud prevention techniques, leveraging automation, anomaly detection, and advanced analytics to stay ahead of evolving threats, and ensure a prompt and effective response.
Adjust fraud prevention controls to protect customers effectively while maintaining trust and minimising friction in HMRC services.

Essential Criteria:

Proven experience in fraud detection, cyber security, or threat intelligence within a large organisation.
Experience using data analysis and Security Information and Event Management (SIEM) platforms, such as Splunk or ELK, preferably in a security operations setting.
Good technical understanding of web and API services and interaction with client applications, including identity proofing authentication processes.
Knowledge of applying kill chain methodology and MITRE ATT&CK, including the use of threat intelligence feeds to classify and detect threat actor activity.
Knowledge of fraud detection techniques, including behavioural analysis and anomaly detection and investigation and OSINT (Open Source Intelligence) methods.
Strong understanding of cyber security principles, including threat intelligence and incident response.
Skilled in reporting, presenting, and visualising complex data in creative, digestible formats for different audiences, from senior leaders to development teams.
Software development and scripting skills in a security or counter-fraud context.
Experience of leading in a technical field, developing others and sharing knowledge.

Desirable Criteria:

Experience of applying machine learning and advanced analytics techniques in fraud detection.
Certifications such as CISM or relevant GIAC qualifications in network defence, threat intelligence and incident handling.
Academic qualifications in science, technology, engineering or maths subjects.

Security clearance:

This role requires SC clearance to take up duty but, candidates must be willing and able to obtain DV clearance once in post. Please note: DV clearance requires continuous UK residency for the past 10 years.

Reserved post

This role is open to UK nationals only.

Transitional Sites

For more information on where you might be working, review this information on our locations.

If your location preference is for one of the following sites, it’s important to note that these are not long-term sites for HMRC and we will require you to move to a new building in the future, subject to our location strategy and the applicable employee policies at that time.

These sites are:

Benton Park View, Newcastle - moving to Pilgrims Quarter, Newcastle
Telford Plaza, Telford - moving to Parkside Court, Telford
Trinity Bridge House, Manchester - moving to an alternative office in Manchester/ Salford

You will be given more information about what this means at the job offer stage.

Leeds Locations

Moves Adjustment Payment will be available for this role, provided the successful applicant is a current HMRC colleague in Bradford and meets the eligibility requirements outlined in the HMRC’s Moves Adjustment Payment guidance.

Technical skills

We'll assess you against these technical skills during the selection process:

Online Fraud Detection
Cybercrime tools and techniques
IT terminology
Data analytics in the context of online fraud detection

Cybersecurity jobs

Cyber Security Officer

Fraud Proactive Protection Lead

Never Miss a New Opportunity