OSINT for Sourcers: Finding Candidates Where No One Else Looks

In the world of talent sourcing, the methods you choose aren't just what sets you apart - they can define your success.

Article main image
Jun 7, 2024

In the world of talent sourcing, the methods you choose aren’t just what sets you apart – they can define your success. With a limited number of qualified candidates available, sometimes the key to securing that crucial placement is what you’re carrying in your toolkit. Open Source Intelligence (OSINT) encompasses a broad array of techniques that gather data from publicly available sources. It’s a field that spans numerous domains, from national security to private sector research, each application tailored to the searcher’s unique needs.

While platforms like LinkedIn and other paid tools are staples in our industry, they represent just a small fraction of the vast resources available for a sourcer who knows where to look. My fascination with OSINT stems from a deep-seated interest in uncovering information from unexpected and often overlooked places. This article will only scratch the surface, offering a glimpse into how OSINT can be applied in talent sourcing.

One out-of-the-box OSINT method I’ve found particularly helpful involves searching through online gift registries that were made for weddings and births. These registries and celebration pages can be surprisingly revealing and may offer the contact information that you need to be able to reach your candidate. Most of these websites allow searches for a couple’s registry or personal celebration page by first and last name. If you’re struggling to find an individual’s contact information, I highly recommend giving this approach a try. You’d be amazed at how many of these sites are publicly accessible and how frequently they include some form of contact detail that could lead you directly to your candidate or at least point you toward additional avenues for finding the email or phone number you need.

Taking this approach one step further, x-raying these websites often reveals job titles and details about career histories within the stories shared about the couple. While you may not gather all the information you need in one go, this method can typically provide enough information to move you to the next step in your search.

Here’s an example – Let’s say that we’re looking for Software Engineers in Seattle. I’d start with a registry website and use this search string below:

This is just a basic sample search that will return several results. If we click into one of these results and examine the couple’s entry for “Our Story” you can see they’ve written about their current roles.

By digging just a bit further into the website – Not only do we have a name and a metropolitan area, but there is actually an address listed as well that we can use to find more information on this candidate.

I’ve included links to a few popular registry sites below as well as a couple of sites that allow you to search multiple registries. There have been times when the folks I need to find are on one of those sites and not the other, so keep both in your back pocket.

This next tool has become one of my favorite methods and has repeatedly proven its worth in uncovering contact information. IntelTechniques is a site developed by a former FBI agent who investigated computer crimes – clearly, someone who knows how to dig deep – and one of the first tools I recommend to people looking to adjust their processes. When I’m on a hunt that takes me through numerous username and email searches, the tools available on the site save a surprising amount of time. Here’s a quick rundown on how I use their username tool:  

  1. I start with a promising username found on LinkedIn or another social media site. 
  2. I then enter the username into the top field and hit “Populate All” to fill in the related fields instantly. 
  3. I can then launch each search individually or use the “Submit All” button to open all relevant searches in new tabs simultaneously

In addition to this username tool, there are also pages for addresses, phone numbers, emails, social media sites, and several others. You can either access these tools online or download them for your use. If you’re tech-savvy, you can even modify them to fit your needs more closely. For me personally, having these tools at my disposal has drastically cut down the time that I’ve spent navigating between sites and has allowed me to streamline my process to keep myself efficient.

Exploring the depths of OSINT to uncover these types of tools not only broadens our horizons but also sharpens our competitive edge in talent acquisition. By tapping into unconventional sources, we can refine our sourcing methods to ensure we’re uncovering the best talent through every possible avenue. As we continue to push the boundaries of what it means to source effectively, I encourage every talent professional to experiment with their strategies and discover new ways to connect with and understand the pursuit of top hires.