The Unfindable Professional

The ask

You want the org chart from the people paid to hide it

Most of us spend our working lives telling other people to shrink their footprint. Scrub the org chart off the public site. Get the executive's home address out of the property records. Stop confirming your employer, your team, your manager and your tech stack to anyone who asks nicely.

Then we apply for a job and get asked for a public profile containing exactly that: our face, our employer, our reporting line, our tooling, and a list of everyone we've worked with for the last fifteen years.

A growing number of employers now treat this as a baseline requirement. Some applicant tracking systems won't accept a submission without a profile URL. Some recruiters read a blank field as a red flag, or assume the candidate is hiding something.

It's an odd request to make of the people you're hiring to keep you out of the news.

What it hands over

A completed profile is a free intelligence product

It confirms who works where, what they do, who they report to, which products they run, and when they moved. Attackers know this. Building a target list for a phishing campaign against a specific company is a fifteen minute job, and the profiles do most of the work.

We know this because we write the reports that say so. Half the incident write-ups in this industry contain some version of "the attacker identified the finance team via publicly available professional networking data." We then go back to our desks and update our own profiles.

Compartmentalization

It works in both directions

Keeping identities and contexts separate is one of the first things this field teaches. Different accounts, different machines, different personas, no bleed between them.

A public professional profile collapses that on purpose. It ties a real name to an employer to a face to a personal network, and it does so on a platform whose business model depends on that link being permanent and searchable. For a lot of roles, particularly offensive security, threat intel, fraud, and anyone whose work involves engaging with people who would rather they didn't, that link is a real problem rather than a philosophical one.

The contradiction

You already pay to undo this

Companies buy executive protection services. They buy data broker removal subscriptions for their staff. They run training that tells employees to be careful what they post. Some of them do all of this and still won't look at a security candidate who doesn't have a public profile with a headshot.

The stated reason is usually professional visibility or networking. That reason makes sense for sales. It makes considerably less sense for the person you want running your detection engineering.

What to ask for instead

The fields that actually tell you something

None of this means candidates should be unverifiable. It means the verification shouldn't require a social media account.

• Skills assessment

  A technical interview or practical exercise tells you more in ninety minutes than a profile does in a year. Profiles are self-written marketing copy, and everyone knows it.

• References

  Direct contact with people who have worked with the candidate. This is the oldest method available and it still works better than anything else.

• Work products

  Published research, tooling, CVEs, conference talks, write-ups, contributions to open source. Plenty of people build a serious public record of competence under a handle, with no legal name attached.

• Community standing

  Vouching within professional communities is how a lot of this industry has always hired. It has obvious problems around who gets access to those rooms, and those are worth fixing, but it isn't less rigorous than reading a profile summary.

• Background checks

  If you need to confirm someone is who they say they are, there is an entire industry that does this properly, under contract, without publishing the results.

In fairness

An empty search result isn't proof of skill

There are excellent engineers with detailed public profiles and active conference schedules, and there are terrible ones with none. Absence of a footprint doesn't tell you much on its own.

The argument here is narrower than that. Requiring a profile filters on something unrelated to the job, and it filters hardest on exactly the people whose reasons for staying quiet are the most professionally sound. That's a bad screen, and it's costing employers candidates they'd want.