The idea
Search engines index public pages on LinkedIn, GitHub and company career sites. X-ray search means asking Google to look only inside one of those sites, using operators that narrow the result set. The classic pattern is site: to restrict the domain, quoted phrases to require exact terms, AND and OR to combine them, and a minus sign to exclude noise.
Recruiters have used this for twenty years because internal site search hides things: LinkedIn limits how many profiles you can view, and job aggregators bury the original posting under reposts. Going through the search index sidesteps both.
What we build for you
You type a role in plain words. We split it into skill terms and location terms, quote each one, pick the right domains for the side you are on, and add the exclusions that remove directory pages and listing spam. Then we run it and rank the results.
Searching for candidates
The query targets LinkedIn profile URLs and GitHub accounts. It looks roughly like this:
(site:linkedin.com/in OR site:github.com) "security analyst" "siem" "toronto" -intitle:"profiles" -inurl:"dir/"
Searching for jobs
Companies publish in three broad places, so the builder offers each as a target. Startups and tech companies mostly use Greenhouse, Lever, Ashby or Workday. Large enterprises, including the Big 4 and most banks, run Taleo, SuccessFactors, iCIMS or SmartRecruiters. Everyone else either uses a mid-market system such as Workable or Jobvite, or hosts jobs straight on their own site.
For that last case there are two routes. Company career pages looks for careers URLs anywhere while excluding the aggregators, and Specific companies targets employers you name — typing "Deloitte" resolves to site:deloitte.com, and one-click sets cover the Big 4, Canadian banks, big tech and consulting firms.
A startup-platform query looks like this:
(site:boards.greenhouse.io OR site:jobs.lever.co OR site:jobs.ashbyhq.com OR site:myworkdayjobs.com) "security analyst" ("remote" OR "canada")
Targeting by country, setup and engagement
Three controls sit on both searches and all three change the query rather than filtering results after the fact.
Country covers 20 countries. On the candidate side it switches LinkedIn subdomain, so choosing Canada searches ca.linkedin.com and the United Kingdom searches uk.linkedin.com — the cleanest way to keep results in one country. On the job side it adds that country's main place names as an OR group, since postings name the city more often than the country.
Work setup is remote, hybrid or on-site. Each expands to the phrasing people really write: remote also catches "work from home" and "distributed"; on-site also catches "onsite", "in office" and "in-office".
Engagement is full-time, part-time or freelance. Full-time also matches "permanent", and freelance also matches "contract", "contractor" and "consultant", which is where most short-term work is actually advertised.
A note on syntax
Two details matter for these queries to actually run. There is never a space after site: itself — site:github.com works, site: github.com does not, because the engine reads the operator and its value as one token. Every clause after it is separated by a space.
Parentheses matter more than they look. Without them, Google binds OR only to the terms either side of it, so site:a.com OR site:b.com "analyst" is read as "site a, or site b that also mentions analyst" — the keyword silently applies to one site instead of all of them, and the search usually returns nothing. Grouping the alternatives fixes it: (site:a.com OR site:b.com) "analyst".
The same applies to any list of alternatives, which is why the builder brackets the country, work-setup and engagement groups too.
Why "all" means several searches, not one
Google stops reading a query at roughly 32 words. A single string naming twenty sites plus your keywords would be cut off mid-way, and the part that gets dropped is usually the part you care about, so the search quietly returns the wrong thing rather than failing loudly.
Choosing "All of them" therefore builds one correctly formed query per group and hands you a search button for each. Coverage is complete, nothing is truncated, and each result set stays readable because it is scoped to platforms that behave alike. Most other x-ray generators restrict you to one platform per search; this is the same idea without the restriction.
Why exact titles find nothing
Job boards rarely use your exact wording. Search "Cyber Security Analyst" as a locked phrase across four boards and you will miss every posting titled "Security Analyst", "Senior Security Analyst" or "Information Security Analyst" — which is most of them. That is why Any order is the default: the same words are still required, just not glued together in that sequence.
Switch to Exact phrase only when the wording really matters, such as a certification name or a specific product.
If a search returns nothing
Each quoted phrase is a hard requirement, so three or four of them across four job boards can genuinely match zero pages. The builder warns you once a query carries three or more, and offers one-click wider versions underneath: any word order, without the city, without the extra skills, or title only. Work down that list rather than rewriting from scratch.
Why we hand the query to Google
We could show results on this page, but only two ways exist to do that: pay for a search API on every keystroke, or keep our own copy of the index. The first is expensive enough that the tool would stop being free, and the second means serving you a snapshot that is out of date the moment it is taken, which is the exact problem x-ray search avoids.
So the builder does the hard part, assembling a correct boolean, and then opens it on the search engine of your choice. Every link you click is live, current, and yours to follow without an account.
If you would rather run the query somewhere else, the copy button gives you the raw string. It is standard boolean syntax, so it works in any engine that supports operators.
What we deliberately do not do
- We do not keep a candidate database, so there is no stale profile pool to search.
- We do not run an applicant tracking system, so nothing about you or the people you find is stored here.
- We do not scrape LinkedIn or sell contact details. You reach people through their own public profiles.