Google Dorking
for Job Search
Google indexes everything companies post publicly - job boards, career pages, PDFs, LinkedIn profiles. Most jobseekers search the surface. Dorking lets you search the structure. Learn the operators that reveal listings before they trend, companies before they post, and roles before they're gone.
12+
Core operators
30+
Query templates
6
ATS targets
What is Dorking?
Google Dorking (also called Google Hacking) uses advanced search operators to filter results with surgical precision. Instead of searching "software engineer jobs", you search site:greenhouse.io "software engineer" "new york" and get direct ATS listings - no aggregators, no sponsored posts, no noise.
For job search, this means finding: roles posted directly on company career pages, listings that haven't been scraped by job boards yet, niche positions at companies that don't advertise widely, and openings at companies you've targeted by name.
Anatomy of a Dork
Core Operators
site:
Search within a specific domain or subdomain.
site:lever.co "machine learning engineer"
inurl:
Match text within the page URL path.
inurl:careers "data scientist" "remote"
intitle:
Match text in the HTML page title.
intitle:"software engineer" site:notion.so
"exact phrase"
Force Google to match the exact string.
"senior data engineer" "open to sponsorship"
OR
Expand results to match either term.
site:greenhouse.io "ML engineer" OR "MLOps"
-exclude
Remove results containing that word.
site:lever.co "backend engineer" -senior -lead
filetype:
Filter by file extension (pdf, doc, csv).
filetype:pdf "we are hiring" "data scientist"
tbs=qdr:
Time filter via URL param. d=day, w=week, m=month.
site:ashbyhq.com "engineer" tbs=qdr:w (append to URL)
cache:
View Google cached version of a page.
cache:boards.greenhouse.io/acme/jobs/12345
related:
Find sites similar to a known one.
related:greenhouse.io
intext:
Match text in the body of a page.
intext:"H1B sponsor" intext:"software engineer"
after:
Filter pages indexed after a date.
site:lever.co "product manager" after:2025-01-01
ATS-Specific Dorks
Each ATS has a predictable URL structure. Target it directly to skip aggregators entirely. Replace the bracketed placeholders with your actual role and location.
Greenhouse
boards.greenhouse.io
site:boards.greenhouse.io "[ROLE]" "[CITY OR REMOTE]"
Greenhouse job IDs increment. Bookmark the listing page, not the apply URL.
Lever
jobs.lever.co
site:jobs.lever.co "[ROLE]" "[CITY OR REMOTE]"
Lever shows team name in URL slug. Filter by team: inurl:/engineering/ or /data/
Ashby
jobs.ashbyhq.com
site:jobs.ashbyhq.com "[ROLE]" "[CITY OR REMOTE]"
Ashby is used heavily by Series A-C startups. Great for early-stage roles.
Workday
*.myworkdayjobs.com
site:myworkdayjobs.com "[ROLE]" "[COMPANY NAME]"
Large enterprises use Workday. Search by company subdomain: site:companyname.wd1.myworkdayjobs.com
SmartRecruiters
careers.smartrecruiters.com
site:careers.smartrecruiters.com "[ROLE]"
Enterprise-scale. Combine with company name in quotes to target specific orgs.
BambooHR
*.bamboohr.com/jobs
site:bamboohr.com "[ROLE]" inurl:/jobs/
Common for SMBs and PE-backed companies. Under-indexed by LinkedIn.
Power Dork Recipes
Copy, customize, and paste into Google. Each recipe targets a specific job-hunting scenario.
01 - Freshly Posted Listings (past week)
site:greenhouse.io OR site:lever.co "[ROLE]" "[CITY]" after:2025-01-01
Combine ATS domains with a date filter to catch listings before aggregators index them. Use after: with a date 7-14 days ago.
02 - H1B Sponsoring Companies
site:greenhouse.io "visa sponsorship" OR "H1B" "[ROLE]"
Many companies disclose sponsorship in the JD text. Google indexes that text. This surfaces relevant listings directly.
03 - Remote-First Roles
site:jobs.lever.co "remote" "data engineer" -"remote not available" -"US only"
Exclude common exclusion phrases to filter out jobs that say remote but mean "remote in California only".
04 - Target a Specific Company
site:company.com inurl:careers OR inurl:jobs "[ROLE]"
Hit the company career page directly. Works for companies that self-host on their own domain instead of an ATS.
05 - Unadvertised Roles via LinkedIn
site:linkedin.com/in "[ROLE]" "[COMPANY NAME]" "open to work"
Find employees at your target company with that role title who are open to work - signals internal movement, new headcount, or upcoming backfill.
06 - PDF Job Postings
filetype:pdf "software engineer" "apply now" OR "send resume" "2025"
Some teams post PDFs to their site or Google Drive. These are rarely on LinkedIn and rarely competitive.
07 - Internship and New Grad Roles
site:greenhouse.io "new grad" OR "entry level" OR "0-2 years" "[FIELD]" "2025"
New grad postings often go live months before the start date. The 2025/2026 text is often in the JD body, not the title.
08 - Startup Job Boards (under the radar)
site:jobs.ashbyhq.com "[ROLE]" -senior -staff -principal
Ashby is the ATS of choice for YC and Series A startups. Filter out senior titles to find IC and mid-level openings.
09 - Role Alias Expansion
site:lever.co "data scientist" OR "ML engineer" OR "applied scientist" "[CITY]"
The same role gets titled differently across companies. Use OR to cast a wider net and catch all naming variants.
10 - Government and Research Roles
site:.gov OR site:.edu "data scientist" OR "data analyst" "apply" "2025"
Government and university roles are often on .gov/.edu domains, invisible on LinkedIn.
Pro Tips
Use time filters via URL
After running a search, click Tools > Any time > Past week. Or manually append &tbs=qdr:w (week), &tbs=qdr:d (day), or &tbs=qdr:m (month) to the Google URL. This is the most reliable way to find fresh listings.
Build a dork sheet for each ATS
Save one query per ATS per target role in a spreadsheet. Run each weekly. Listings on Greenhouse and Lever sometimes expire within 48 hours for hot roles.
Dork LinkedIn for internal signals
site:linkedin.com/in "[ROLE]" "[COMPANY]" reveals current employees. Recent hires in a function suggest headcount growth. Departures signal backfill. Both are job leads.
Search GitHub for hiring signals
site:github.com "we are hiring" OR "join our team" "[ROLE]" - Some engineering teams post job openings in README files or GitHub Discussions. These are almost never on LinkedIn.
Target company press releases
"[COMPANY NAME]" "we are hiring" OR "we are growing" site:prnewswire.com OR site:businesswire.com after:2025-01-01 - Funding announcements often precede job postings by 2-4 weeks.
Use cache: to recover expired listings
If a listing 404s, Google may still have a cached version. Use cache:boards.greenhouse.io/company/jobs/123456 to get the JD text and identify the hiring manager.
Combine dorks with OR brackets
(site:greenhouse.io OR site:lever.co OR site:jobs.ashbyhq.com) "staff engineer" "remote" - Parentheses group OR terms. One query covers three ATS platforms at once.
Alert on new results
Take any dork query and create a Google Alert for it at google.com/alerts. Google will email you when new pages matching that dork are indexed - passive job search on autopilot.
Quick Reference
| Operator | Use For | Example |
|---|---|---|
| site: | Restrict to domain | site:greenhouse.io "engineer" |
| inurl: | Match URL text | inurl:/jobs/ "data scientist" |
| intitle: | Match page title | intitle:"hiring" "machine learning" |
| "phrase" | Exact match | "open to sponsorship" |
| OR | Either term | "ML" OR "machine learning" |
| -word | Exclude term | "engineer" -senior -lead |
| filetype: | File type filter | filetype:pdf "we are hiring" |
| after: | Posted after date | after:2025-01-01 |
| tbs=qdr:w | Past week (URL param) | append to Google URL |
| cache: | Cached page | cache:lever.co/jobs/12345 |
| intext: | Match body text | intext:"H1B" intext:"data" |
| related: | Similar sites | related:greenhouse.io |