How to Find Passive Candidates on LinkedIn

Ninety percent of the candidates you want aren't on the job board. They're not searching, not applying, and not updating their headline to say "open to opportunities." They're heads-down at their current job, and the only way to reach them is to go find them. Here's the actual process — not the theory, the steps — for doing that on LinkedIn without a €30K/year seat license.

Start with Boolean, but know its ceiling

LinkedIn's own search (and Recruiter, if you have it) still runs on keyword matching. That means your first move is a clean Boolean string. For a mid-level backend engineer role, something like:

("backend engineer" OR "software engineer" OR "platform engineer") AND (Python OR Go OR Golang) AND ("microservices" OR "distributed systems") NOT (intern OR junior)

Run that in LinkedIn's search bar, filter by location and "Past company" or "Current company" if you're targeting specific employers, and you'll get a workable first list. Sales Navigator (roughly $99/month for the Core plan) adds filters that regular LinkedIn search doesn't have — years in current role, company headcount, and the ability to save searches and get alerted to new matches. If you're doing this more than occasionally, Sales Navigator earns its cost back in the first search.

But here's the ceiling nobody tells you about upfront: Boolean search only finds people who describe themselves the way you searched. A senior engineer who calls himself a "Staff Engineer," a "Technical Lead," or — increasingly — just "Building cool stuff at [startup]" won't show up in a search for "software engineer." Internal data across sourcing tools consistently points to somewhere around 30–40% of qualified candidates carrying titles that don't match the obvious keyword. That's not a rounding error. That's a third of your pool, invisible.

This matters most for senior and specialist roles, where title inflation and vague self-branding are common, and least for junior or highly standardized roles (a "Registered Nurse" is a "Registered Nurse" everywhere). Know which kind of search you're running before you assume Boolean got you everything.

Use LinkedIn's own signals before you touch a paid tool

Before reaching for anything that costs money, squeeze what LinkedIn gives you free.

"People also viewed" on any strong candidate's profile is an underrated goldmine — LinkedIn is showing you people with overlapping networks and similar profiles, which often surfaces near-identical candidates you'd never have found by keyword.

Alumni tool (linkedin.com/school/[school-name]/people) lets you filter a university's alumni by where they work now, what they studied, and what they do — useful for building a first list from a specific talent pipeline, like a coding bootcamp or a target engineering school.

Skills endorsements and the "Skills" section often reveal capability that a title hides. Someone titled "Product Manager" with 40 endorsements for SQL and Python might actually be doing technical PM work you're trying to fill.

Groups and Events — LinkedIn still runs both, and a person who's active in a niche group (say, a Kubernetes SIG or a regional fintech founders group) has told you something about their specialization that their job title never will.

Comment sections on industry posts are one of the highest-signal, lowest-effort sources going. If someone leaves a technically sharp comment on a post about vector databases, they probably know more about the topic than their LinkedIn headline suggests.

None of this costs anything beyond time. If you're sourcing for one or two roles a month, this manual layer might be all you need — don't buy a tool to solve a problem you can solve with an hour of clicking.

Read profiles the way a recruiter reads a resume, not the way a keyword filter reads text

Here's the mental shift that separates good sourcers from people who just run searches: read the whole profile, not just the title line.

Open a profile and check, in order: current title, then the About section (people often self-describe more accurately here than in their title), then the actual bullet points under their current role, then their skills, then their past roles for career trajectory. A candidate titled "Growth Marketing Lead" whose About section says "I run SEO and paid acquisition for B2B SaaS" is a completely different candidate than one whose About section says "I manage a team of 12 across brand and comms." Same title. Different job.

This is slow. A recruiter doing this manually for 40 candidates might spend 4–6 hours per role just reading profiles and deciding who's actually qualified versus who just has the right words on their page. That's the real cost of quality sourcing, and it's the reason enterprise tools like SeekOut, hireEZ, and Findem exist — they try to automate the semantic read, not just the keyword match. Whether that automation is worth €10K–€90K a year depends entirely on your volume. If you're running 2–3 searches a month, it isn't. If you're running 20+, the math changes.

Filter for "passive" specifically, not just "qualified"

Qualified and passive are different filters, and conflating them wastes outreach. A candidate is passive if they're not actively job-hunting — which means most of your search results, since only a small fraction of any given talent pool is actively looking at any moment.

A few tells that someone's genuinely passive versus quietly job-hunting:

• Tenure at current role. Someone 18 months into a role they seem engaged with (posting about their team's work, engaging with company content) is more passive than someone at 6 months with a stale profile.
• Recent activity pattern. A sudden burst of profile views, connection requests to recruiters, or a freshly updated headline are soft signals of active searching — not necessarily passive.
• The Open to Work banner. Obviously, if it's on, they're not passive — they're active, and probably already getting outreach from five other recruiters. Passive candidates never show this.
• Career stage. Someone mid-promotion cycle or newly leveled up is usually less receptive than someone who's been static in the same role/level for 2+ years.

This is where most manual sourcing breaks down — Boolean search and LinkedIn filters don't distinguish passive from active, so you end up spending outreach credits on people who are either not job-hunting at all (fine, that's the point) or already flooded with recruiter messages (a worse use of your time than someone who almost never hears from recruiters).

Write outreach that doesn't read like the other nine messages in their inbox

Passive candidates get pitched constantly, so generic outreach is the fastest way to get ignored. Two things separate a reply from a delete:

Real signal, not manufactured signal. "Saw your comment on the [specific post] about migrating off Kubernetes" beats "I love what you're doing at [Company]." The second line is the most common cold-outreach tell there is, and passive candidates have seen it a hundred times.

No personalization if you don't have one. If you can't find a real signal — no recent posts, no comments, no obvious project to reference — don't fake it. A short, honest, generic message ("I'm hiring a senior backend engineer for a Series B fintech, comp band €90–120K, fully remote — is this relevant to you right now?") reads better than a strained attempt at personal connection.

Keep the first message under 80 words. State the role, the comp band if you can, and one specific reason you're reaching out to them. Skip the flattery.

When manual sourcing is the wrong tool for the job

If you're sourcing for one role a quarter, none of the above needs automating — Boolean search plus an hour of profile-reading will get you there. But if you're running 10+ active searches, doing this by hand starts costing real hours you could spend on candidate calls instead.

That's the gap tools like SeekOut, hireEZ, Findem, Fetcher, and Gem are built for — and also why they carry €10K–€90K/year price tags and usually require a LinkedIn Recruiter seat underneath them. If you don't have that budget or that seat, worth knowing there's a cheaper middle ground: humaaaaans reads a profile semantically the way a recruiter would, so it catches the non-obvious-title candidates that pure Boolean search misses, without requiring a Recruiter license. First search is free, no card needed, so you can run the same role through it and through your own Boolean string and compare the lists yourself.

Either way — manual, Boolean, or tool-assisted — the fundamentals don't change: read the whole profile, filter for passive versus active separately from qualified versus unqualified, and write outreach that proves you actually looked at the person before you messaged them.