By clicking "I accept" you consent to the use of cookies on our website to support technical features and anonymous statistics
25/02/2026, 23:55
700
£36,057
£4,218
£ 3,000
Information about the Command
Threat Leadership is responsible for the national response to the Serious Organised Crime (SOC) threats. Our role is to work with partners both inside the NCA and externally to set the strategic direction, facilitate effective delivery of the response, and ensure we understand the impact of our activity. Adopting a threat-led and intelligence driven approach, we identify emerging challenges and changes to the threat landscape. A key objective is to tackle SOC threats by maximising the benefit of new capability across the system. This approach means we can achieve more with the resources we have and be more effective developing business cases to enhance our response. Driving the multi-agency UK 4P (PURSUE, PREVENT, PROTECT, PREPARE) response by agreeing threat priorities, influencing tasking of operational activity across law enforcement, facilitating partner action and informing policy, regulatory and legislative changes to better protect the public. Threat Leadership leads the national response for Organised Immigration Crime (OIC), Modern Slavery and Human Trafficking (MSHT), Drugs, Firearms, Child Sexual Abuse (CSA) and Borders. Threat Leadership is also home to the National Cyber Crime Unit, which combines Cyber threat leadership with an operational response.
Information about the Business Area
National Cyber Crime Unit (NCCU) is the UK lead for tackling the threat from cyber crime - a single Unit with the responsibility and capability to deliver operations, lead the overall UK response, coordinate activity across a range of partners, and provide specialist cyber support and expertise across law enforcement.
The National Cyber Crime Unit’s (NCCU) Tactical Research & Development (TR&D) team is a specialist capability within the National Crime Agency (NCA), comprising operational deployment experts and technical developers who support both national and international investigations.
As a member of TR&D you will design, develop and deploy sophisticated covert capabilities and toolsets that directly support and enhance intelligence collection. These capabilities are used in complex investigations into high‑end serious and organised crime (SOC), including Cyber Crime, Child Sexual Exploitation, Firearms, Controlled Drugs and Organised Immigration Crime.
As an Officer within TR&D you will work closely with NCA investigative teams, UK policing partners and international law enforcement agencies, providing specialist advice and delivering innovative, niche technical solutions. Typical areas of work include malware analysis, cryptocurrency tracing, incident response, network infrastructure investigations and covert device monitoring.
TR&D is a small, highly collaborative team that values innovation, problem‑solving and teamwork. We are seeking an individual who can thrive in a cooperative environment, can tackle complex challenges creatively, and be able to produce clear, high‑quality written reports to an evidential standard.
In this role, you will have the opportunity to undertake external training courses to support your professional development. These courses can be highly valuable; however, successful candidates will be expected to achieve the required pass standard for all training undertaken.
In addition to external courses, the post-holder must either already hold, or be willing to complete, mandatory training in Personal Protective Safety Training (PPST/OST) and First Aid.
Important Note
Please note that this role may involve exposure to material relating to Child Sexual Exploitation (CSE). Individuals involved in child sexual abuse and exploitation target some of the most vulnerable members of society, and the NCA is committed to preventing and disrupting this criminal activity.
As part of this role, you may be required to work directly or indirectly on investigations that involve exposure to child sexual abuse images and related material. Applicants should carefully consider the sensitive nature of this work and their personal resilience before deciding to apply.
The NCA places a strong emphasis on safeguarding and staff wellbeing. Robust welfare measures are in place, including access to specialist occupational health services, wellbeing support and managerial oversight. Employees working in these areas are supported through structured safeguarding processes, with appropriate guidance, training and opportunities to access additional support when required.
Operational Deployment - Deploy in response to time‑critical and active criminal incidents within the UK and internationally, providing specialist technical support to live investigations.
Data Analysis and Intelligence Development - Analyse and interpret complex data sets to produce targeted intelligence and evidential packages for investigation teams, law enforcement partners and government stakeholders.
Subject Matter Expertise - Develop and maintain specialist knowledge in cyber‑related disciplines, becoming a subject matter expert in areas such as malware, encryption, obfuscation techniques and cryptocurrencies.
Technical Support and Capability Development - Provide advanced technical support and design bespoke technical solutions to support NCCU/NCA investigation teams and UK and international law enforcement partners.
Partnership and Collaboration - Work closely with UK and international partners across government, academia and industry to build effective relationships, share knowledge, develop techniques and establish best practice.
Digital Forensics and Method Development - Contribute to the development, testing and implementation of new digital forensic methods, tools and operational procedures.
Continuous Capability Improvement - Continuously enhance cyber investigation capabilities to ensure the NCA remains effective against emerging technologies, evolving criminal methodologies and new threat landscapes.
Report Writing and Communication - Strong report writing and drafting skills, with the ability to produce clear, concise and accurate written material for investigative and evidential purposes.
IT Literacy - Proficient in the use of Microsoft Office applications, including Word, Excel, PowerPoint and Outlook.
Specialist Cyber Capability - Willingness and ability to develop specialist technical skills and progress towards subject matter expertise in cyber‑related areas such as malware, encryption, obfuscation techniques and cryptocurrencies.
Case and Information Management - Experience of managing case material in accordance with NCA policies and procedures, the Code of Ethics and relevant information management standards.
Cyber and Threat Awareness - A sound understanding of how emerging technologies create opportunities for offenders, including the associated risks to children and vulnerable persons.
Legislative Knowledge - In‑depth knowledge and practical application of relevant UK and international legislation impacting law‑enforcement activity.
Digital Forensics Knowledge - Knowledge of digital forensic principles, including the handling of data in a forensically sound manner. Understanding of forensic tools and methods used to process data and present findings clearly to a range of audiences.
Networking Knowledge - Knowledge of computer networking fundamentals, including networking layers, data transmission from source to destination, and methods for capturing and analysing network traffic.
Operating Systems, Software and Coding Expertise - In‑depth knowledge of Windows and comparable operating systems, with the ability to identify, locate and extract data of evidential value for law‑enforcement purposes. Advanced understanding of operating system and software environments, including Linux file systems and the Windows Registry. Experience using command‑line utilities such as Terminal and PowerShell. Working knowledge of coding and scripting languages, such as Python and Bash, to support analysis, automation and investigative activity.
Technical Experience and Qualifications - Proven experience and/or relevant qualifications in one or more of the following areas: Digital forensics; Penetration testing; Reverse engineering; Malware analysis.
Networking Technologies - Experience with networking technologies, including TCP/IP and DNS, and practical experience capturing, configuring and analysing network traffic.
Operational and Project Delivery - Demonstrable experience of managing operational or project delivery within time‑critical environments, delivering outputs to required standards and deadlines.
All NCA employees are members of the UK Civil Service and eligible for the Civil Service pension scheme, alongside your salary the NCA contributes £10446. Further information on the benefits of the scheme is available on the Civil Service Pension Website.
New entrants to the NCA receive 26 days annual leave, rising to 31 on completion of 5 years continuous service, plus 8 bank holidays.
If qualifying criteria is met new joiners from UK Police Forces or the UK Intelligence Community (UKIC) will have service with those employers taken into account for continuous service purposes for annual leave entitlement only, this will be up to a maximum of 31 days leave (including 1 privilege day).
Other benefits include:
Further information is available on the NCA Website.
Longlist
In the event of a high number of applications, we may operate a longlist. Applicants will need to meet the minimum pass mark for the lead criteria.
- Working knowledge of coding (e.g. Python) and/or scripting languages (e.g. Bash). [Lead Criteria] .
Candidates who do not meet the minimum pass mark for the lead criteria will not progress to having their other criteria assessed. Applications must meet the minimum criteria to be progressed to the assessment stage.
You will receive an acknowledgement once your application is submitted.
We aim to have sift completed and scores released within 10 working days of the closing date of the advert. For high volume campaigns this timeframe may be extended.
Scores will be provided but further feedback will not be available at this stage.
The format of this assessment will be In-Person Assessment which will be tested on via the details listed below.
Candidates who pass the application sift will be invited to an in-person assessment in either London or Birmingham. This will be a written assessment to assess your knowledge and understanding of all the criteria listed in the job advert. Assessments are scheduled to take place between the 2nd and 6th of March 2026.*
Please be aware that candidates will not be reimbursed for any travel or subsistence costs when attending the assessment centre.
Candidates that pass the written assessment will be invited to a virtual interview. Interviews are scheduled to take place between 16th and 20th of March.*
* Please be aware that dates are subject to change and will be confirmed at point of invitation.
The format of this assessment will be Interview which will be tested on the criteria listed in the Success Profiles at Assessment section.
In the event of a tie at the assessment stage, available roles will be offered in merit order using the following order:
If you meet the criteria for a lower grade, you may be offered that role if not appointable at the advertised grade.
Conversely, if found appointable at a higher grade but no posts are available, you may be offered a lower-grade role.
All offers are made based on merit.
We’re proud to be a Disability Confident Leader and an inclusive, equal opportunities employer.
We’re committed to creating a workplace where everyone can be their authentic self. If you’re neurodiverse, have a disability, or live with a long-term health condition, we encourage you to let us know about any reasonable adjustments you may need during the recruitment process.
If you experience accessibility issues with the advert or require reasonable adjustments, please contact our Recruitment Team at Central.Recruitment@nca.gov.uk before the advert closing date.
Please ensure you complete the ‘Equal opportunities’ and 'Reasonable Adjustments' sections in the application form to inform us on what support you may need in the recruitment process.
For more on our Disability Confident commitment, visit Disability Confident Scheme | Civil Service Careers.
Visit NCA Benefits and Support for more details.
The Civil Service is committed to attract, retain and invest in talent wherever it is found. To learn more please see the Civil Service People Plan and the Civil Service Diversity and Inclusion Strategy
In order to monitor the effectiveness of the National Crime Agency's Diversity & Inclusion strategy, we require certain personal details about you on submission of your application for statistical and monitoring purposes only. Please note that this will be treated in confidence and will not impact your application.
The Civil Service Code sets out the standards of behaviour expected of civil servants.
We recruit on merit through fair and open competition, in line with the Civil Service Commission's Recruitment Principles.
The Civil Service also offers a Redeployment Interview Scheme to civil servants who are at risk of redundancy, and who meet the minimum requirements for the advertised vacancy.
If you believe your application has not been treated fairly, email: Central.Recruitment@nca.gov.uk (quoting the vacancy reference). If unresolved, you may escalate your complaint to the Civil Service Commission.
This vacancy is closed to applications.
