Find Passive Candidates on LinkedIn by Skill (2026 Guide)

Thirdwatch's LinkedIn Candidate Finder finds passive candidates by exact skill match across publicly indexed LinkedIn profiles. Pass skills like "kubernetes", "react native", or "financial modeling" and get back structured candidate data -- name, headline, and profile URL. No LinkedIn login required. Built for technical sourcers and recruiting teams who need skill-specific shortlists without manually constructing boolean search queries.

Why find passive candidates by skill on LinkedIn

The most qualified candidates are rarely active applicants. According to LinkedIn's Talent Solutions data, passive candidates make up roughly 70% of the global workforce, and they tend to be 120% more likely to want to make an impact at their next company compared to active applicants. The practical problem: finding these people. They are not on job boards, not responding to postings, and not visible in applicant tracking systems. They exist on LinkedIn, with their skills listed in headlines, summaries, and experience sections -- but surfacing them requires search.

Most technical sourcers resort to Google x-ray searches: site:linkedin.com/in/ "kubernetes" "senior" "San Francisco". This works for one-off searches but breaks down when you need to systematically cover a skill matrix across multiple locations. A DevOps team hiring for 3 roles across 4 metros needs 12 separate queries, each manually copy-pasted and formatted. The LinkedIn Candidate Finder automates the skill-matching layer: pass the skills you need, get structured profiles back.

How does this compare to the alternatives?

Three paths for skill-based passive candidate sourcing:

Apollo and ZoomInfo are strong for contact enrichment but their skill taxonomies lag behind emerging technologies. A sourcer searching for "dbt" or "langchain" may get zero results in those platforms while LinkedIn profiles already mention these tools. The Candidate Finder matches against whatever candidates have actually written in their profiles, catching emerging skills that fixed taxonomies miss.

How to find passive candidates by skill in 4 steps

Step 1: How do I authenticate with the Apify API?

Create a free account at apify.com, navigate to Settings, then Integrations, and copy your API token.

export APIFY_TOKEN="apify_api_xxxxxxxxxxxxxxxx"

Step 2: How do I search for candidates with specific technical skills?

Pass exact skill phrases in the skills array. Each phrase is matched against the candidate's publicly indexed profile content.

import os, requests, pandas as pd

ACTOR = "thirdwatch~linkedin-candidate-finder-scraper"
TOKEN = os.environ["APIFY_TOKEN"]

resp = requests.post(
    f"https://api.apify.com/v2/acts/{ACTOR}/run-sync-get-dataset-items",
    params={"token": TOKEN},
    json={
        "role": "DevOps Engineer",
        "skills": ["kubernetes", "terraform", "aws"],
        "location": "Berlin",
        "maxResults": 30,
    },
    timeout=300,
)
df = pd.DataFrame(resp.json())
print(f"{len(df)} DevOps candidates with k8s + terraform + AWS in Berlin")
print(df[["fullName", "headline", "url"]].head(10))

The actor matches each skill as an exact phrase. "kubernetes" matches "Kubernetes", "KUBERNETES", and "kubernetes" -- case-insensitive. For compound skills, use the full phrase: "react native" rather than "react" (which would also match React.js web developers).

Step 3: How do I search across a skill matrix for multiple roles?

Technical sourcing often involves a skill matrix -- multiple roles, each with different skill requirements. Run one query per skill combination and tag the results.

SKILL_MATRIX = {
    "ML Engineer": {
        "skills": ["pytorch", "mlops", "python"],
        "location": "San Francisco",
        "seniority": "senior",
    },
    "Platform Engineer": {
        "skills": ["kubernetes", "golang", "aws"],
        "location": "San Francisco",
        "seniority": "senior",
    },
    "Frontend Lead": {
        "skills": ["react", "typescript", "design systems"],
        "location": "New York",
        "seniority": "lead",
    },
}

all_results = []
for role_name, params in SKILL_MATRIX.items():
    resp = requests.post(
        f"https://api.apify.com/v2/acts/{ACTOR}/run-sync-get-dataset-items",
        params={"token": TOKEN},
        json={
            "role": role_name,
            "maxResults": 40,
            **params,
        },
        timeout=300,
    )
    for c in resp.json():
        c["target_role"] = role_name
        c["skills_searched"] = ", ".join(params["skills"])
    all_results.extend(resp.json())

df = pd.DataFrame(all_results).drop_duplicates(subset=["url"])
print(f"{len(df)} unique candidates across {len(SKILL_MATRIX)} roles")
print(df.groupby("target_role").size())

Deduplicate on url after merging -- a candidate with both Kubernetes and PyTorch may appear in multiple role segments.

Step 4: How do I filter results and prioritize outreach?

Use the headline field as a first-pass relevance signal. Candidates whose headlines mention your target skills and a recognizable employer are higher-priority outreach targets.

# Score candidates by headline relevance
priority_keywords = ["senior", "staff", "lead", "principal"]
target_companies = ["google", "meta", "stripe", "airbnb", "databricks"]

def score_candidate(row):
    headline_lower = row["headline"].lower()
    score = 0
    score += sum(2 for kw in priority_keywords if kw in headline_lower)
    score += sum(3 for co in target_companies if co in headline_lower)
    return score

df["priority_score"] = df.apply(score_candidate, axis=1)
df = df.sort_values("priority_score", ascending=False)

# Top 20 candidates for outreach
outreach_batch = df.head(20)
outreach_batch.to_csv("outreach_batch.csv", index=False)
print(f"Top 20 candidates exported for outreach")

For candidates who score high on headline relevance, enrich with the LinkedIn Profile Scraper to get full experience, education, and skills before reaching out.

Step 5: How do I use keywords for niche certifications or domain terms?

Beyond skills, the keywords array lets you add domain-specific terms -- certifications, industry verticals, or education signals.

resp = requests.post(
    f"https://api.apify.com/v2/acts/{ACTOR}/run-sync-get-dataset-items",
    params={"token": TOKEN},
    json={
        "role": "Security Engineer",
        "skills": ["penetration testing", "cloud security"],
        "location": "London",
        "country": "UK",
        "keywords": ["CISSP", "OSCP"],
        "maxResults": 25,
    },
    timeout=300,
)
df = pd.DataFrame(resp.json())
print(f"{len(df)} certified security engineers in London")

The keywords field is additive to skills -- both must match. Use keywords for signals that are not technical skills: certifications (CISSP, PMP, CFA), education (PhD, Stanford, IIT), or domain terms (fintech, healthtech, SaaS).

Sample output

Skill-specific searches return targeted candidate profiles. A batch from the DevOps query above:

[
  {
    "fullName": "Stefan Mueller",
    "headline": "Senior DevOps Engineer at Delivery Hero | Kubernetes, Terraform, AWS",
    "url": "https://www.linkedin.com/in/stefan-mueller-devops/"
  },
  {
    "fullName": "Priya Kapoor",
    "headline": "Platform Engineer at N26 | Infrastructure as Code | Ex-ThoughtWorks",
    "url": "https://www.linkedin.com/in/priya-kapoor-platform/"
  },
  {
    "fullName": "Lukas Weber",
    "headline": "Staff SRE at Zalando | Kubernetes, Go, Observability",
    "url": "https://www.linkedin.com/in/lukas-weber-sre/"
  }
]

The headline is the candidate's self-authored LinkedIn headline. It typically contains their current role, employer, and key skills -- exactly the signals a sourcer needs for first-pass triage. Note that not every candidate lists all their skills in the headline; some keep it minimal. For those profiles, feed the url into the LinkedIn Profile Scraper to see their full skills and experience.

Common pitfalls

Three issues surface in skill-based passive sourcing. Skill name ambiguity -- searching for "react" matches both React.js frontend developers and React Native mobile developers. Use the full phrase ("react native" or "react.js") when the distinction matters. Similarly, "python" matches Python developers but also data analysts who mention Python as a secondary tool. Combine skills to narrow: "python" + "fastapi" targets backend engineers more precisely than "python" alone. Over-stacking skills -- requiring 5+ skills in a single search dramatically shrinks the pool because not all candidates list every skill publicly. Start with 2-3 core skills, review the results, then add a fourth only if the pool is too broad. Ignoring emerging skill names -- candidates adopt new terminology faster than recruiter queries do. "LLM fine-tuning" may be more productive than "machine learning" for AI engineering roles in 2026. Check what candidates actually write in their profiles and mirror that language in your skills array.

The actor handles query construction and skill-phrase matching so you focus on evaluating the candidate pool, not debugging boolean syntax. For a deeper guide on sourcing strategy, Recruiting Daily's 2025 sourcing benchmarks provide industry response rates by channel that help calibrate outreach expectations.

Related use cases

• Scrape LinkedIn candidates for recruiter sourcing
• Build a talent pipeline from LinkedIn candidate data
• Track talent market trends with LinkedIn candidate data
• Build a candidate shortlist from LinkedIn profiles
• Build LinkedIn thought leadership dataset
• LinkedIn Candidate Finder — actor page
• The complete guide to scraping job boards
• All Thirdwatch use-case guides