Cyber Digital Forensics Officer

National Crime Agency

Apply before 11:55 pm on Sunday 3rd March 2024



Reference number



£30,740 - £39,648
Roles based in London will receive an additional London Weighting of £3,595. Recruitment and Retention Allowance: This is currently set at £3,000 for this post. The RRA is an enhancement to the role and is reviewed annually.
A Civil Service Pension with an average employer contribution of 27%

Job grade

Executive Officer
NCA Grade 5 / Police Constable

Contract type


Length of employment

Loan or Secondment - 2 years

Business area

Investigations Directorate

Type of role

Operational Delivery

Working pattern

Flexible working, Full-time, Job share

Number of jobs available



Bristol, Kingston-upon-Thames, Warrington

Job summary

We are seeking experienced digital forensics (DF) practitioners, who can demonstrate their ability to  examine an array of digital devices to an evidential standard, looking for an opportunity to develop their skills into the specialist field of Cyber Digital Forensics. 

The Cyber DF team are skilled technical officers, responsible for the preservation, capture and analysis of an array of digital evidence sources, used in the commission of cybercrime. 

Learn more about this role

To learn more about this role, please register for the following event:
On 29th November and 17th January from 18:00, we are hosting an MS Teams event where you can hear from NCA officers and be given the opportunity to ask questions about the role.

Attendance is by invitation only. To register, please contact ASAP with the subject NCA – Cyber Digital Forensics Officer Event

Job description

Cyber DF officers also have a responsibility to attend crime scenes to preserve digital media and volatile data, to ensure maximum evidential recovery. This also extends to Cyber Incident Response activity, working with partners to ensure evidential recovery in some of the most dynamic environments. 

Applicants will work closely with the other teams within Forensic Services, to ensure effective and efficient forensic support and delivery to investigations.

At the NCA, we celebrate diversity and are committed to creating an inclusive environment. We welcome neurodivergent thinkers and offer reasonable adjustments to those who need them.

Once proficient in standard DF practices, in-line with the Agency’s quality standards, candidates will specialise in niche areas of data capture and analysis including incident response, network forensics, malware analysis, log analysis and database rebuilding.

Although this post is based within a laboratory, there is a requirement to deploy to crime scenes nationally and potentially internationally. This can be at short-notice, involving some anti-social/long hours, requiring overnight stays. 

***To be considered, you will need to successfully complete SC Enhanced clearance before commencing the role and achieve DV clearance within the first 12 months in post.**

Person specification


  • Acquisition of various digital media to an evidential standard;
  • Laboratory based examination and analysis of acquired digital media, including but not limited to: computers, servers and virtual infrastructure; 
  • Scene based preservation and acquisition of digital evidence to secure resident and volatile data and maximise evidential recovery, including incident response in the wake of major cyber incidents; 
  • Collaborative working with Law Enforcement and industry partners;
  • Work to quality standards, maintaining and developing the scope of accredited activity across the Agency; 
  • Provide support to core investigative functions including disclosure, exhibit handling and presentation of written and oral evidence;
  • Complete specialist areas of technical analysis, such as network forensics and malware analysis;
  • Evidential reporting, and court attendance as required,  following forensic activity.


Full UK Driving Licence (includes full EU licences).


The following qualifications/skills are essential to the role and proof will be required at interview:

Intermediate certification in digital forensics – computer examinations – or equivalent experience.

Please ensure the dates of any accreditations you are relying on, are entered on to the CV.
Should you progress to the assessment stage of the process, you will be required to provide a copy of the original certificate.
Failure to provide evidence at interview may result in your application not progressing to the next stage.


We'll assess you against these behaviours during the selection process:

  • Working Together
  • Changing and Improving

Technical skills

We'll assess you against these technical skills during the selection process:

  • Understanding and demonstrable knowledge of digital forensic practices (lab or scene based).
  • Ability to communicate technical detail to a wide-ranging audience.
  • Experienced in the forensic examination of computers.
  • Demonstrable interest in the cyber threat landscape.
Alongside your salary of £30,740, National Crime Agency contributes £8,299 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides.

Whatever your role, we take your career and development seriously, and want to enable you to build a really successful career with the Agency and wider Civil Service.

If you are an active police pension member immediately prior to joining the NCA, you can continue your membership throughout your employment with us as if you were a serving police officer. If you do remain an active member and subsequently return to a police force, you should be able to continue your membership there too.

All officers in the NCA are members of the UK Civil Service. You will be eligible for:

  • Civil Service pension scheme
  • 26 days annual leave rising to 31 on completion of 5 years continuous service
  • Training and development opportunities
  • Cycle2work scheme

We take the welfare of NCA officers very seriously. All staff have access to Occupational Health services and there are a number of staff representative groups. We also have a range of sporting and other activities on offer.

We can provide flexible working arrangements if the role in question is suitable. These include flexi-time, job sharing and compressed hours (working contracted hours over a shorter period).

Selection process details

This vacancy is using Success Profiles (opens in a new window), and will assess your Behaviours, Experience and Technical skills.

If you wish to apply for this vacancy, you must submit your application by:

Tranche 1: Sunday 10th December 2023 at 23.55
Tranche 2: Sunday 7th January 2024 at 23.55
Tranche 3: Sunday 4th February 2024 at 23.55
Tranche 4: Sunday 3rd March 2024 at 23.55

You will be asked to complete a CV as part of the application process,  Please see the candidate information pack for more information.

During your application process your CV will assess the following criteria:

  • Intermediate certification in digital forensics – computer examinations – or equivalent experience.
  • Full UK driving licence (includes full EU licences)

Please note depending on the volume of applications a Longlist at sift may be conducted on following criteria:

Understanding and demonstrable knowledge of digital forensic practices (lab or scene based).

Candidates must pass this criteria for their application to be progressed.

A panel will then assess your application to select those demonstrating the best fit for the role by considering the evidence you have provided against the criteria set out in the Entry Criteria section.

Failure to address any or all of these may affect your application.

Sift results are expected to be released w/c;

Tranche 1: Week commencing Tuesday 2nd January 2024.
Tranche 2: Week commencing Monday 22nd January 2024
Tranche 3: Week commencing Monday 19th February 2024
Tranche 4: Week commencing Monday 18th March 2024

Interviews will take place:

Tranche 1 - Throughout January and February 2024
Tranche 2 - Throughout February 2024
Tranche 3 - Throughout March 2024
Tranche 3 - Throughout March 2024

Locations to be confirmed. Please be advised that the type of interview (eg. virtual/face-to-face) may be subject to change and successful candidates will be notified of this prior to attending. However the interview is conducted, the interview criteria will remain as shown on page 17 of the candidate information pack.

The above sift and interview dates are an indicative timeline.

Should you be successful at sift but cannot attend on the interview date(s) listed the recruitment team cannot guarantee an alternative date. Please contact the recruitment team.

You will then be asked to attend an interview in order to have a more in-depth discussion of your previous experience and professional competence. 

Full details of the assessment process will be made available to shortlisted candidates.

Please ensure that all examples provided in your application are taken directly from your own experience and that you describe the examples in your own words. Any instances of plagiarism including copying of examples/answers from internet sources will result in a withdrawal of your application. Further action, including disciplinary action, may be considered in such cases involving internal candidates. Providing false or misleading information would be contrary to the core values of honesty and integrity expected of all Civil Servants.


Where more than one location is advertised, candidates will be appointed in merit order for each location. You will be asked to state your location preference on your application.

Please be aware that you can be posted to any location that you put in your preferences. If you would only like to be posted to one location, please confirm one location only. If you are posted to a location that you have requested and you do not accept that location, you may not be offered another role.

Please note, only advertised location can be offered. Notes populated in a free text box will not be taken into consideration.

Near Miss

Candidates who are judged to be a near miss at interview may be considered for other positions in the NCA which may be at a lower grade, but have a potential skills match.

Hybrid Working

Here at the NCA we have a hybrid working arrangement in place enabling officers to work a proportion of their role remotely. Eligibility and the degree of home working will vary depending on the requirements of the role. Further details can be discussed at offer stage.

Reasonable Adjustment

We are committed to ensuring our recruitment process is inclusive and accessible to all. As part of our application process you will be prompted to provide details of any reasonable adjustment to our recruitment process that you may need. If you have a disability or long-term condition (a physical or mental impairment that has a substantial and long term effect on your ability to carry out normal day-to-day activities protected under the Equality Act 2010) and need us to make any adjustments or do anything differently during the recruitment process, please let us know by emailing, we have a duty to make reasonable changes to our processes.

If you need a change to be made so that you can make your application, you should:

Complete the “Assistance required” section in the “Additional requirements” page of your application form to tell us what changes or help you might need further on in the recruitment process. For instance, you may need wheelchair access at interview, or if you’re deaf, a Language Service Professional.

Please contact us by emailing or calling 0117 372 0000 as soon as possible before the closing date if you wish to discuss any reasonable adjustments before applying.

Inclusion and Accessibility

The NCA embraces and values diversity in all forms. Being truly reflective of the communities we serve and building a culture where everyone can perform at their best is critical to leading the UK’s fight against serious and organised crime – something which affects us all. We want to recruit and retain the very best and broadest diversity of officers so the NCA welcomes applications from individuals from all backgrounds.

We are proud to be an inclusive, equal opportunities employer. As a Disability Confident Leader we are committed to ensuring that all candidates are treated fairly throughout the recruitment process.

If you are experiencing accessibility problems with any attachments on this advert, please contact


All security clearances require you to provide evidence of your UK footprint where you have been physically present in the UK.

The requirement for SC clearance is to have been present in the UK for at least 3 of the last 5 years.

Failure to meet the residency requirements will result in your security clearance application being rejected.

If you require SC clearance you will need to provide evidence of the below requirements.

Checks will be made against:

  • Departmental or company records (personnel files, staff reports, sick leave reports and security records)
  • UK criminal records covering both spent and unspent criminal records.
  • Your credit and financial history with a credit reference agency
  • Security Services records



All security clearances require you to provide evidence of your UK footprint where you have been physically present in the UK.

The requirement for DV is to have been present in the UK for at least 7 of the last 10 years.

Failure to meet the residency requirements will result in your security clearance application being rejected.

If you require DV clearance you will need to provide evidence of the below requirements.

Checks will be made against:

  • successful completion of the BPSS
  • UK criminal record and identity checks
  • credit reference checks
  • relevant personnel and medical checks (if required)

We encourage all candidates to thoroughly review the candidate pack which explains the role further before submitting an application.

If you have any specific queries about the role that are not covered by the candidate pack, please contact:

Feedback will only be provided if you attend an interview or assessment.


Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check (opens in a new window).

See our vetting charter (opens in a new window).
People working with government assets must complete baseline personnel security standard (opens in new window) checks.


Successful candidates will be expected to have a medical.

Nationality requirements

This job is broadly open to the following groups:

  • UK nationals
  • nationals of the Republic of Ireland
  • nationals of Commonwealth countries who have the right to work in the UK
  • nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS) (opens in a new window)
  • nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
  • individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
  • Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service
Further information on nationality requirements (opens in a new window)

Working for the Civil Service

The Civil Service Code (opens in a new window) sets out the standards of behaviour expected of civil servants.

We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window).
The Civil Service embraces diversity and promotes equal opportunities. As such, we run a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.
The Civil Service also offers a Redeployment Interview Scheme to civil servants who are at risk of redundancy, and who meet the minimum requirements for the advertised vacancy.
This vacancy is part of the Great Place to Work for Veterans (opens in a new window) initiative.
Once this job has closed, the job advert will no longer be available. You may want to save a copy for your records.

Contact point for applicants

Job contact :

  • Name : NCA Recruitment Team - GRS
  • Email :

Recruitment team

  • Email :

Further information

If you feel your application has not been treated in accordance with the Recruitment Principles and you wish to make a complaint in relation to any stage of the recruitment and selection process please email please ensure that you refer to the campaign reference number. If you remain dissatisfied following the outcome of your complaint you have the right to contact the Civil Service Commission to pursue it further.

If you are not satisfied with the response you receive from the Department, you can contact the Civil Service Commission:

Share this page