Job summary
The NHS Counter Fraud Authority (NHSCFA) is the national body responsible for all matters relating to the prevention, detection and investigation of economic crime across the NHS.
This role at NHSCFA must hold security clearance SC level as a minimum. To meet National Security Vetting requirements, you must have resided in the UK for a minimum of 3 out of the past 5 years for SC clearance. More information on SC clearance can be found here National security vetting: clearance levels - GOV.UK (www.gov.uk) . Please make sure you meet these requirements before applying for this role. You don't need to have SC already, however, failure to achieve the requirements for SC after offer, will result in the job offer being withdrawn.
Our new team are embarking on a piece of work to monitor data to identify and respond to patterns indicative of potential fraud. This will support our current work that reduces the likelihood of fraud occurring. We will bring in data science capabilities to be deployed in counter fraud activity and work closely with partners across health and government to further maximise the preventative impact of proactive counter fraud analysis. At the core will be the development and use of appropriate analytical techniques that include advanced analytics and machine leaning to tackle some of the highest areas of fraud risk to the NHS and ultimately protect public funds for patient care.
Main duties of the job
The post holder will work as part of the NHS Counter Fraud Authority (NHSCFA) Digital Forensics Unit (DFU), within the Operations Directorate, whose responsibility is to investigate allegations of fraud bribery and corruption in the NHS.
The Senior Digital Forensics Investigator will work as part of a dedicated team who work to identify, preserve, extract, interpret and present computer based digital evidence and provide an efficient and effective Digital Forensics service as well as support function to NHSCFA, NHS England, Department of Health and Social Care Anti-Fraud Unit (DHSC AFU), Counter Fraud Services (CFS) Wales, Counter Fraud Services (CFS) Scotland, Local Counter Fraud Specialists (LCFS') and any other contracted external customers.
Potential applicants can contact Nikki Crook at nikki.crook@nhscfa.gov.uk for an informal chat if you have any questions regarding the role. This is a fixed-term contract until the end of March 2025.
We reserve the right to close this vacancy before the advertised closing date should we receive a significant number of applications.
Interviews will be held 18th/22nd April 2024.
About us
The NHSCFA values and respects the diversity of its employees and aims to recruit a workforce which reflects our diverse communities. We welcome applications irrespective of people's age, disability, gender, race or ethnicity, religion or belief, sexual orientation, or other personal circumstances. We have policies and procedures in place to ensure that all applicants are treated fairly and consistently at every stage of the recruitment process, including an invitation to the first stage of the selection process and consideration of reasonable adjustments for people who have a disability. If you are applying to undertake this role on a secondment basis you should have agreement to being released from your current role in principle, prior to submitting an application form. When you apply for this role, you will be redirected to our recruitment system TRAC. Please apply without delay as we reserve the right to close any vacancies from further submissions when we have received sufficient applications from which to make a shortlist. The NHSCFA does not hold a sponsor licence in respect of skilled worker visas and so is unable to employ candidates requiring sponsorship.
Please note this role attracts Inner London HCAS.
Job description
Job responsibilities
Conducting forensic acquisition, processing and analysis activities (either on site or in the lab) of digital media for use in investigations by the NHSCFA and external
Recording the details of analysis and investigations undertaken and maintain the confidentiality of this information.
Ensuring that appropriate security and access control of forensics tools, systems and evidence is maintained at all times.
To properly collect, preserve, transport, and store systems and media used in investigation and evidence uncovered by analysis.
Producing statements and exhibits to a standard suitable for use in criminal or civil.
Please see full Job Description and Person Specification.
Job description
Job responsibilities
Conducting forensic acquisition, processing and analysis activities (either on site or in the lab) of digital media for use in investigations by the NHSCFA and external
Recording the details of analysis and investigations undertaken and maintain the confidentiality of this information.
Ensuring that appropriate security and access control of forensics tools, systems and evidence is maintained at all times.
To properly collect, preserve, transport, and store systems and media used in investigation and evidence uncovered by analysis.
Producing statements and exhibits to a standard suitable for use in criminal or civil.
Please see full Job Description and Person Specification.
Person Specification
Specialist Knowledge
Essential
- Demonstrate knowledge in at least some of the following areas / operating systems. oFile servers (Microsoft / Apple / Unix / Linux) oNetworking (IP / LAN / WAN / Firewalls) oEmail servers and clients. oPeripherals (e.g. removable media, CD/DVD etc). oWorkstations (Microsoft / Apple / Unix / Linux). oFile systems (FAT / NTFS / HFS+ APFS etc). oHard drives (IDE, SCSI, SSD, RAID, SAN etc).
- Extensive knowledge in one or more of the following FTK, EnCase, Axiom, Cellebrite Inspector, , Digital Collector, UFED or Oxygen forensic tools.
- Demonstrable knowledge of current best practice in obtaining electronic evidence
- Thorough understanding of issues surrounding the proper handling of evidence within an investigatory environment.
Desirable
- Working knowledge of programming/scripting in EnScript, Python, SQL or similar language.
- Working knowledge of Exterro LAB// /FTK Central or similar Ediscovery platform
Experience
Essential
- Practical experience in an investigative role.
- Extensive practical experience in undertaking digital forensic investigations.
- Significant practical experience in exhibiting evidence and producing witness statements suitable for Crown court.
Qualifications
Essential
- Degree or equivalent in Digital Forensics or equivalent experience working within a digital forensics environment, or Information Technology related field or equivalent experience working within a digital forensics environment.
Desirable
- Either hold any of the following professional qualifications or demonstrate equivalent knowledge and experience. oMicrosoft Certified Professional (M.C.P.). oAccess Data Certified Examiner (ACE)oEnCase Certified Examiner (EnCE). oSuccessfully completed Forensic Computing Foundation Level Course
Communication Skills
Essential
- Demonstrate the ability to prioritise and manage own workload to deliver operational objectives.
- Demonstrable understanding and track record in promoting equal opportunities and diversity.
- Ability to work to agreed deadlines and standards, manage conflicting priorities, work with minimum supervision and develop solutions for overcoming barriers to progress. This requires high levels of enthusiasm, self-motivation and adaptability.
- Be able to make an effective contribution within a team environment by providing advice, assistance and support to colleagues
- Must be able to use fine/precision screwdrivers in order to safely remove and replace storage media (such as Hard Drives, Solid State Disks, NVMe) from Computers, Laptops and Servers)
Person Specification
Specialist Knowledge
Essential
- Demonstrate knowledge in at least some of the following areas / operating systems. oFile servers (Microsoft / Apple / Unix / Linux) oNetworking (IP / LAN / WAN / Firewalls) oEmail servers and clients. oPeripherals (e.g. removable media, CD/DVD etc). oWorkstations (Microsoft / Apple / Unix / Linux). oFile systems (FAT / NTFS / HFS+ APFS etc). oHard drives (IDE, SCSI, SSD, RAID, SAN etc).
- Extensive knowledge in one or more of the following FTK, EnCase, Axiom, Cellebrite Inspector, , Digital Collector, UFED or Oxygen forensic tools.
- Demonstrable knowledge of current best practice in obtaining electronic evidence
- Thorough understanding of issues surrounding the proper handling of evidence within an investigatory environment.
Desirable
- Working knowledge of programming/scripting in EnScript, Python, SQL or similar language.
- Working knowledge of Exterro LAB// /FTK Central or similar Ediscovery platform
Experience
Essential
- Practical experience in an investigative role.
- Extensive practical experience in undertaking digital forensic investigations.
- Significant practical experience in exhibiting evidence and producing witness statements suitable for Crown court.
Qualifications
Essential
- Degree or equivalent in Digital Forensics or equivalent experience working within a digital forensics environment, or Information Technology related field or equivalent experience working within a digital forensics environment.
Desirable
- Either hold any of the following professional qualifications or demonstrate equivalent knowledge and experience. oMicrosoft Certified Professional (M.C.P.). oAccess Data Certified Examiner (ACE)oEnCase Certified Examiner (EnCE). oSuccessfully completed Forensic Computing Foundation Level Course
Communication Skills
Essential
- Demonstrate the ability to prioritise and manage own workload to deliver operational objectives.
- Demonstrable understanding and track record in promoting equal opportunities and diversity.
- Ability to work to agreed deadlines and standards, manage conflicting priorities, work with minimum supervision and develop solutions for overcoming barriers to progress. This requires high levels of enthusiasm, self-motivation and adaptability.
- Be able to make an effective contribution within a team environment by providing advice, assistance and support to colleagues
- Must be able to use fine/precision screwdrivers in order to safely remove and replace storage media (such as Hard Drives, Solid State Disks, NVMe) from Computers, Laptops and Servers)
Disclosure and Barring Service Check
This post is subject to the Rehabilitation of Offenders Act (Exceptions Order) 1975 and as such it will be necessary for a submission for Disclosure to be made to the Disclosure and Barring Service (formerly known as CRB) to check for any previous criminal convictions.
Employer details
Employer name
NHS Counter Fraud Authority
Address
7th Floor, HM Government Hub
10 South Colonnade, Canary Wharf
London
E14 4QQ
Employer's website
https://cfa.nhs.uk/ (Opens in a new tab)
