Fraud Operational Lead

As the Fraud Operational Lead within HMRC’s Fraud Prevention Centre (FPC), you will play a pivotal role in protecting HMRC’s Identity Verification & Authentication (IDV&A) services. You’ll lead advanced data analysis efforts to detect, investigate, and prevent fraudulent activity, while mentoring junior colleagues and shaping the evolution of our fraud intelligence capabilities.

This is a dynamic, high-impact position that will evolve as the team maturesideal for a proactive, analytical thinker who thrives in ambiguity and is eager to drive innovation.

Key Responsibilities:

• Data Analysis & Fraud Detection: Analyse billions of customer data events to detect identity-related fraud. Apply techniques such as clustering, outlier detection, data mining/matching, and pattern analysis.
• Visualisation & Reporting: Produce high-quality, insightful reports and dashboards. Present technical findings clearly to non-technical stakeholders, including senior leadership.
• Tool Development & Automation: Use basic scripting (e.g. Excel functions) to automate analysis, develop visualisations, and build scalable, efficient analytical tools.
• Collaboration & Casework: Work closely with CCG and security colleagues to investigate complex fraud, understanding offender tactics and supporting operational responses.
• Process Improvement: Identify and lead service improvement initiatives across data analysis and fraud detection processes.
• Strategic Support: Track and report performance metrics, support project planning, and align identity risk reporting with wider compliance strategies.
• Stakeholder Engagement: Engage stakeholders across HMRC (e.g. CCG, RIS, CS&TD) to influence behaviour change and shut down fraudulent activity.
• Leadership & Mentoring: Provide technical guidance and potentially line management to junior analysts. Champion IDV&A initiatives across HMRC.
• Deputising & Representation: Act on behalf of the G6 Risk & Operations Lead as needed.

Essential Criteria:

• A degree in Data Analysis, Data Science, Cyber Security, or Information Security, or a minimum of 3 years’ proven experience in a relevant cyber or identity-related role.
• Demonstrated experience using Security Information and Event Management (SIEM) platforms (e.g. Splunk, Elastic) within a security operations environment with the ability to script searches.
• Knowledge of how web services operateincluding browsers, cookies, IP addresses, and authentication protocols.
• Familiarity with fraud and security risks affecting digital services.

Desirable Criteria:

• CISMP qualification, or commitment to obtain it.
• Strong interpersonal and communication skills, with experience influencing across technical and non-technical teams.
• Experience mentoring or managing junior colleagues and fostering data capability within teams.
• An inquisitive mindset, with a passion for uncovering root causes and solving complex problems.