Find the right people and their emails¶
For anyone with a target company list but no names. Finish with 1 to 2 named people per company, each with a verified email or a LinkedIn route, logged in your tracker.
Who to find at each company¶
| Target | Title keywords to search | Where they show up | Use them for |
|---|---|---|---|
| University recruiter | university recruiter, campus recruiter, early career recruiter, university recruiting, emerging talent | LinkedIn, Handshake, career fair booths | Interns and new grads: status, timeline, events |
| Technical recruiter | technical recruiter, technical sourcer, talent acquisition | LinkedIn, inbound InMails | 0 to 3 years: status and process after you apply |
| Hiring manager | engineering manager, software development manager (Amazon's SDM), software engineering manager | LinkedIn, the job post's hiring team, engineering blogs, talks | A 15-minute chat; cold email works best here |
| Engineer on the team | software engineer, SDE, SWE, plus the team's keyword | LinkedIn, GitHub, engineering blogs, talks | Advice first, referral after a real conversation |
| Alumni at the company | your school plus the company | LinkedIn Alumni tool | Warm chat, then referral |
| Past interns | your school plus "intern" plus the company | LinkedIn Alumni tool | Intern referrals and what the loop felt like |
| Professors, TAs, lab managers | your department | Department and lab pages | Research roles and intros to industry |
Who to contact first, and for what, is on the outreach strategy page. Target 1 to 2 people per company per wave: Hunter's 2026 data on 31 million emails found contacting 1 to 2 people per company got a 46% higher reply rate than contacting more (Hunter State of Email Outreach 2026).
LinkedIn people search, step by step¶
- Type any keyword in the LinkedIn search bar and press Enter, then click the People tab.
- Open All filters and set Current company to your target. This is more reliable than typing the company name as a keyword.
- Paste a search string from the next section into the search box.
- Add filters: Locations (the team's city), Connections (start with 2nd), and School (your school) for warm angles.
- Run each search once and open only the profiles you would actually message. People searches count toward LinkedIn's monthly commercial use limit (stay inside LinkedIn's limits).
- For each person, write down name, title, team, and one specific thing they built, wrote, or posted. Jugal's tip: "before you write anything, find one specific thing the person built, wrote, or posted" (7 videos on networking).
- Log them in your tracker (follow-up and tracking) before you send anything.
Search operator rules from LinkedIn (LinkedIn Help: Boolean search):
| Rule | Example |
|---|---|
| Operators must be uppercase: AND, OR, NOT | recruiter AND Google |
| Quotes for exact phrases | "university recruiter" |
| Parentheses to group | (SDE OR "software engineer") AND payments |
| Order of evaluation: quotes, then parentheses, then NOT, then AND, then OR | Wrap every OR group in parentheses |
| Not supported: wildcards (*), braces, brackets, angle brackets | engineer* does not work |
| Plus and minus are not officially supported | Use AND and NOT instead |
Tip: Free accounts accept fewer operators per query, so keep strings short and split long ones in two (100hires: LinkedIn Boolean search).
Copy-paste LinkedIn search strings¶
Set Current company to the target first, then paste one of these into the search box.
University and campus recruiters (interns and new grads):
("university recruiter" OR "campus recruiter" OR "early career recruiter" OR "university recruiting" OR "emerging talent")
Technical recruiters (0 to 3 years):
("technical recruiter" OR "technical sourcer" OR "talent acquisition") AND (engineering OR software)
Recruiters who mention early careers anywhere on their profile:
Hiring managers:
Engineers on a specific team (swap in the team's keywords from the job post):
Past interns from your school (also set the School filter):
Remove agency recruiters from any recruiter search:
India campus hiring teams:
("campus hiring" OR "university hiring" OR "campus recruiter" OR "talent acquisition") AND (India OR Bengaluru OR Hyderabad)
UK and Europe graduate recruiters:
Jugal's strings, from his Holy Grail of Networking guide and How I got 47 recruiter messages within a month. Use these without the Current company filter, since the company is in the string:
Finding Recruiters: ("Talent Acquisition" OR Recruiter OR "HR Manager") AND [Company Name]
Finding Hiring Managers: ("Hiring Manager" OR "Engineering Manager" OR "VP Engineering") AND [Industry]
Finding Alumni: [Your University] AND ("Software Engineer" OR Developer) AND [Target Company]
Finding by Seniority: ("Senior" OR "Lead" OR "Principal") AND [Job Title] AND [Company/Industry]
People posting they hire: "Software Engineer" AND "Google" AND "Hiring"
Tip: For interns and new grads, a university recruiter beats a general technical recruiter. University or early-career teams usually own intern and new grad pipelines.
Use the job post itself¶
- Open the job on LinkedIn. If it shows Meet the hiring team, you can connect with and message everyone listed there, including the job poster (LinkedIn Help: jobs through social hiring). Use template E3 or C5.
- In LinkedIn Jobs, turn on the Hiring in your network filter to see jobs posted by your connections (same help page). Those posters are your warmest contacts.
- Do Jugal's fresh-post move: filter LinkedIn jobs to roles posted in the last 3 days, then message the team lead before the crowd finds the post (The Job Hunt I Didn't Burn Out Doing). Template: H4.
- Read the job description for the team or org name (for example "Payments Infrastructure" or "AWS Lambda"). Search that name with the Current company filter to find the manager and engineers.
- Note the job ID now. Every message you send later carries it.
Use the LinkedIn Alumni tool¶
Alumni are the warmest strangers you have. Shared school is your common ground. Steps from LinkedIn Help: the Alumni tab:
- Search your university's name on LinkedIn and open its school page (not the group).
- Click Alumni in the left-side navigation.
- In Where they work, type the target company.
- In What they do, pick Engineering (or Information Technology).
- In What they studied, pick Computer Science or your major.
- Type a keyword such as
internornew gradin the search box on that page to surface recent grads. LinkedIn removed the graduation-year filter from the Alumni tab, so keywords are the workaround. - Sort your list: same degree program first, then same clubs or labs, then people who joined the company in the last 1 to 3 years (closest to your situation).
- Send template C4 (under 200 characters). After they accept, send A1 or A5.
Google X-ray search¶
X-ray search means using Google to search public LinkedIn profiles. Use it when LinkedIn's own search hits its monthly limit. Rules:
- No space after the colon:
site:linkedin.com/inworks,site: linkedin.com/indoes not (Google Search Help: refine searches). - Put titles in quotes. Use a minus sign to exclude a word.
- Use a country subdomain to narrow by country, such as
site:uk.linkedin.com/inorsite:in.linkedin.com/in(100hires: LinkedIn X-ray search). - Expect stale results. LinkedIn narrowed what Google indexes in early 2024, and public profiles take weeks or months to refresh in search engines (same 100hires guide). Confirm the person's current role on LinkedIn before you write.
Copy-paste strings (swap the company, city, and school):
site:linkedin.com/in ("university recruiter" OR "campus recruiter" OR "early career recruiter") "Google"
site:linkedin.com/in ("engineering manager" OR "software development manager") "Amazon" "Seattle" -recruiter
site:in.linkedin.com/in ("campus hiring" OR "university hiring" OR "talent acquisition") "Microsoft" "Hyderabad"
Watch out:
intitle:andORwork in practice but are not on Google's documented operator list. If a string returns nothing, remove one part at a time.
Other places to find the right people¶
| Source | What you find | How to use it |
|---|---|---|
| Company engineering blogs and conference talks | Engineers and managers with public work | Read one post or watch one talk, then use H1 or M1. The author's name plus the company is enough to find them on LinkedIn. |
| GitHub user search | Engineers by location, language, followers | GitHub has no employer qualifier. Open the company's GitHub organization and its People tab, or search location:"Seattle" language:Go followers:>50. Contribute an issue or small PR first, then mention it (C10). |
| Handshake | US campus recruiters, school career fairs, employer events | Free for students at participating schools. Complete your profile, then register for every event your target companies host. Jugal calls it the most underused tool in his 2026 tool stack. |
| Career fairs and conferences | Recruiters and engineers in person | Plan 10 booths in advance. Full plan: career fairs. Conference scholarships and company travel grants can pay for the trip (get the trip paid for). |
| MLH hackathons | Student hackathons in North America, Europe, and Asia Pacific | Build a project in a weekend and meet the engineers judging or mentoring. The event list does not promise recruiters, so treat recruiting as a bonus. |
| Blind | Anonymous employees, some offering referrals | Search "[Company] referral". Expect to share your resume through a link and give up anonymity. See referrals. |
| ADPList | Mentors from tech companies, free to start | Practice your chat ask and get resume feedback before you contact people at your top targets. |
| Professors, TAs, lab managers | Research roles, intros to former students in industry | Jugal: grad students and lab managers often do the shortlisting, so email them too (The $0 Masters post). Template: E5. |
| LinkedIn Sales Navigator (paid, free trial) | 50+ filters, including function, seniority level, and years at company | Start the free trial only during your heaviest 2 to 4 weeks of outreach, and cancel before billing. interviewing.io estimates a month or two "will run you a few hundred dollars" (interviewing.io part 2). |
Stay inside LinkedIn's limits¶
| Limit | What LinkedIn says | What to do |
|---|---|---|
| Personalized notes | Free members: 3 a month on one help page, 5 on another; 200 characters each (a563153, a550555) | Spend notes on hiring managers, alumni, and engineers at top targets. Send other requests without a note and message after they accept. |
| Invitations | No published weekly number. Restrictions come from sending many invitations quickly, many being ignored, left pending, or marked as spam, or suspected automation tools (a551012). Hitting the limit usually blocks sending for about a week (a550555). | Send 10 to 20 targeted requests a week. Withdraw requests pending more than 3 weeks. Never use automation tools. |
| Commercial use limit | Applies when search activity looks like hiring or prospecting. Counts: profile searches, the People Also Viewed panel, and the People tab on company pages. Does not count: searching a name in the top search box, browsing your 1st-degree connections, job search. Resets at midnight Pacific on the 1st of each month. LinkedIn does not show how many searches remain (a564226). | Search in focused batches. Once you know a name, search it in the top box (free). Switch to Google X-ray when you hit the limit. |
| Premium Career (paid) | Unlimited personalized notes (a563153); 5 InMail credits a month, up to 15 banked, and an InMail is credited back if the person accepts, declines, or replies within 90 days (a543695). US$39.99 a month as of Oct 2026 (Premium Career). | Buy one month only for your heaviest outreach weeks, or use the free trial and cancel before it bills. Jugal's routes to cheaper Premium: How I Got LinkedIn Premium for Free. The Microsoft student offer in that post (January 2026) has since expired. |
| Network size | 30,000 first-degree connections max (a551012) | Not a real constraint for students. Relevance beats size. |
Watch out: Do not scrape LinkedIn or use auto-connect tools. LinkedIn restricts accounts it suspects of automation (a551012). Jugal's own n8n post warns readers to mind LinkedIn's Terms of Service (Ultimate Job Search Workflow).
Find the email address¶
Hiring managers "live in their emails", so email beats LinkedIn for them (interviewing.io part 2). Recruiters and engineers you can usually reach on LinkedIn.
- Write down the person's full name exactly as on LinkedIn.
- Find the company's email domain. Check the careers site footer, the press page, or a recruiter's email signature. Use the domain (
stripe.com), not the company name. - Run Hunter Email Finder: enter first name, last name, and domain. It checks a database of 100 million+ public addresses, then infers the likely pattern, and shows sources and a confidence score. Failed searches are free.
- If Hunter finds nothing, try one backup from the tools table below.
- If every tool fails, guess with the patterns below, then verify each guess.
- Verify every address before sending. Use the decision table below.
- Log the address, the tool, and the verification status in your tracker.
Email finder and verifier tools (free tiers as of Oct 2026)¶
| Tool | Free tier | How to use it |
|---|---|---|
| Hunter (freemium) | 50 credits a month. 1 credit per email found, 0.5 per verification; the same search counts once per billing period. Paid from $49 a month, or $34 a month billed yearly. | Spend credits on hiring managers and engineers on your exact team. Use Email Finder (name + domain), not Domain Search, so each credit buys a specific person. |
| Hunter Email Verifier (freemium) | Up to 100 verifications a month. Checks format, MX, SMTP, and accept-all without sending an email. Statuses: Valid, Accept-all, Invalid. | Verify every guessed address before you send. |
| Snov.io (freemium) | Trial plan renews monthly: 50 credits, 100 recipients. Paid from $39 a month. | Backup finder when Hunter's credits run out. |
| Apollo (freemium) | A free plan exists; on free plans you can connect Gmail only for sending. Credit numbers are not shown on the public pricing page, and third parties disagree. | Filter by company and title (for example "University Recruiter"). Check your credit balance in the app after signup. Jugal pairs Apollo or Hunter with his 15-minute chat email (M3) in his AI job application tools post. |
| RocketReach and ContactOut (freemium) | Free allowances could not be confirmed on their pricing pages (as of Oct 2026). interviewing.io uses RocketReach to turn a LinkedIn URL into an email. | Use any free lookups on your top 5 hiring managers only. |
| FindThatLead and SignalHire | Freemium contact finders. Jugal lists FindThatLead in How I Got Interviews at Amazon, Meta & Startups and SignalHire in The Job Hunt I Didn't Burn Out Doing. Free limits not verified here. | Last-resort backups. |
| Truelist | Free email validation; resolves many catch-all "unknown" results | Run every Accept-all result from Hunter through it. interviewing.io recommends it for catch-all checks. |
| MailTester.com | 100 free verification credits on a new account, no card | Second opinion on a guessed address. |
| mail-tester.com (a different site) | Free spam score for a draft email | Send your template to its test address before any mail merge. Fix anything it flags. |
Watch out: Clearbit Connect no longer exists. HubSpot sunset it, along with the free Clearbit platform, on April 30, 2025 (Clearbit). Older guides, including some of Jugal's earlier posts, still list it.
Guess the pattern¶
- Find one real address at the domain first. Search Google for the domain in quotes plus a work word, for example
"@stripe.com" engineer, and check papers, conference speaker pages, and open-source READMEs written by the company's engineers. Copy that format. - If you find nothing, try interviewing.io's three fallbacks (firstname@, first initial + lastname@, firstname.lastname@), then the common variants below (interviewing.io part 2).
- Verify each guess in Hunter Email Verifier before you send. Stop at the first Valid result.
Example person: Priya Shah at example.com.
| Order | Pattern | Example |
|---|---|---|
| 1 | first | priya@example.com |
| 2 | first initial + last | pshah@example.com |
| 3 | first.last | priya.shah@example.com |
| 4 | firstlast | priyashah@example.com |
| 5 | first_last | priya_shah@example.com |
| 6 | first + last initial | priyas@example.com |
Watch out: Guessing is unreliable at big tech. Third-party pattern databases disagree even for Google and Amazon (Prospeo on google.com, Clay on Amazon), and large companies often use usernames rather than full names. If no guess verifies, reach the person on LinkedIn instead.
Decide what to send¶
| Verifier result | What it means | What to do |
|---|---|---|
| Valid | The mailbox accepts mail | Send |
| Accept-all (catch-all) | The domain accepts everything, so the check cannot confirm the person | Run it through Truelist or MailTester.com. Still unsure: use LinkedIn instead. |
| Invalid | The mailbox does not exist | Drop it. Try the next pattern. |
| Unknown or timeout | The server did not answer | Do not send. Try again in a day or use LinkedIn. |
Tip: Bounces hurt your sender reputation. Hunter's 2026 data puts the average bounce rate at 3.6% (Hunter 2026). Never send to an unverified guess in bulk.
Budget the free credits¶
| Plan | Math | Result |
|---|---|---|
| Hunter free, Email Finder only | 50 credits, 1 per person found; failed searches are free | 25 companies at 2 people each, per month |
| Hunter free, verify guesses | 0.5 credits per verification | Up to 100 verifications a month |
| Jugal's Referral Engine defaults | "Limit: 10 contacts per company" via Hunter Domain Search (The Referral Engine) | About 5 companies a month on free credits. Turn on the post's optional People/HR/Recruiting/Talent department filter and lower the limit to 1 to 2 per company: about 25 to 50 companies a month. Setup: n8n automation. |
Rules: privacy, law, and safety¶
- Email one person at a time, with your real name, an honest subject line, and a real reason tied to them.
- Stop the moment someone asks you to. Never re-add them to a later batch.
- Send from your personal Gmail or your university address. Do not buy a new domain for outreach: Gmail requires SPF or DKIM authentication from every sender and expects a low spam rate (Gmail sender guidelines), and a brand-new domain has no reputation.
- Stay far below Gmail's sending cap. A personal Gmail account is blocked for 1 to 24 hours after more than 500 emails in a day (Gmail sending limits). Jugal's own pace is 10 to 15 emails a day (The Job Hunt I Didn't Burn Out Doing).
- Do not harvest emails from GitHub commits. Many are private noreply addresses anyway (GitHub Docs: commit email).
- Do not use downloaded "HR contact" spreadsheets or PDFs. They hold other people's personal data, and they go stale fast.
- US: the CAN-SPAM Act covers email whose primary purpose is advertising a commercial product or service (FTC CAN-SPAM guide). A one-to-one job inquiry is likely outside it, but follow its habits anyway: real name, honest subject, honor opt-outs. This is not legal advice.
- UK: the ICO says the PECR email marketing rule does not apply to corporate subscribers, but UK GDPR still applies to an email that identifies a person. Do not hide your identity, give a way to opt out, and respect objections (ICO: business-to-business marketing). This is not legal advice.
- Check any recruiter who contacts you. Find the role on the company's official careers site and match the email domain. "Honest employers, including the federal government, will never ask you to pay to get a job" (FTC: job scams).
Build your contact list¶
- List 20 to 30 target companies, each with 1 to 3 live job IDs (application strategy).
- International students: check sponsorship before you find a single contact (international students). Jugal once got a referral, tailored everything, and then heard "Unfortunately, we do not sponsor visas at this time" (How to Check if a Company Sponsors H-1B Visas).
- For each company, find 1 to 2 people using the order on the strategy page.
- Record these columns for each person: Company, Role, Job ID, Contact name, Contact type (recruiter, HM, engineer, alumni, friend), Channel, Email, Verification status, LinkedIn URL, One specific thing about them, First touch date, Follow-up dates, Replied, Next action. A full tracker template is on follow-up and tracking.
- Check the company page for that company's process before you write, for example Google, Meta, Amazon, Microsoft, or Stripe.
Checklist¶
- 20 to 30 target companies, each with at least 1 live job ID
- Sponsorship checked for every company (if you need it)
- Ran the university recruiter or technical recruiter string for each company
- Found the hiring manager or one engineer on the exact team for my top 10
- Ran the Alumni tool for every target company
- Wrote one specific thing about each person
- Found and verified emails for hiring managers (Valid, or Accept-all confirmed by a second checker)
- Stayed under 20 connection requests a week and withdrew stale pending requests
- Logged every person in my tracker with a first-touch date