# Sourcing Cleared Candidates From Public Signals Into a Ranked Shortlist

*You will turn a cleared-role requirement into a ranked shortlist of likely clearance holders inferred from public signals and screened on what you may lawfully ask.*

- Canonical URL: https://www.refolk.ai/guides/sourcing-cleared-candidates-public-signals
- Pillar: Recruiting and sourcing
- Format: Playbook
- Published: 2026-10-02
- Last reviewed: 2026-10-02
- Reading time: 17 min

You have a defense or federal contract role that requires a specific security clearance, and almost none of the people who hold that clearance say so on a public profile. This guide is for in-house recruiters, sourcers, and talent leaders who need to build a shortlist of likely clearance holders anyway. It gives you an end-to-end method to read clearance level, type, and reactivatable eligibility off public signals, screen that read against what you may lawfully ask, and rank the result into a shortlist you can work.

The prevailing advice on cleared sourcing ends at "a public profile won't tell you, so buy a specialized database." That advice is half right and gives up too early. The level is hidden, but the signals that imply it are not, and they are searchable on the open web. What follows turns a population that "isn't searchable" into a ranked, lawfully screened list.

## Why self-stated clearance level is a dead end

Cleared candidates almost never publish their clearance level, so searching for the level directly returns a tiny, unrepresentative slice of the real population. You have to infer level from proxy signals instead.

The scale of the gap is the whole reason this guide exists. In Refolk's index of professional profiles, 293,528 US profiles carry both a "Security Clearance" signal and a "TS/SCI" signal. That sounds like a searchable population. But the moment you intersect an explicit TS/SCI tag with a single job title, the number collapses.

**3 - US profiles with an explicit TS/SCI tag and the title "Software Engineer" in Refolk's index**

The same index holds 293,528 profiles carrying "Security Clearance" and "TS/SCI" signals, so the level itself is almost never stated against a real role.

The signal density table below shows the collapse directly. It is the clearest evidence that self-stated level is not a filter you can build on.

| Query (US) | Profiles |
| --- | --- |
| "Security Clearance" + "TS/SCI" signals | 293,528 |
| Explicit "TS/SCI" tag + "Software Engineer" | 3 |
| Explicit "Secret Clearance" tag + "Software Engineer" | 2 |

So the method is not "search for cleared people." It is "search for the signals that cleared people leave, then infer level and reactivatability from the combination." The rest of this guide is that method.

> **Note:** What the clearance levels are
>
> The hierarchy runs Confidential, Secret, Top Secret, then Top Secret with Sensitive Compartmented Information (TS/SCI), with CI-scope or full-scope polygraph as add-ons. DOE runs parallel Q and L access authorizations, and non-national-security roles use Public Trust. When this guide says "infer level," it means placing a candidate on this ladder from indirect signals.

## The lawful filter comes first

Before you source a single name, fix the legal boundary, because the enforcement risk in cleared hiring lives in inference, not in the clearance requirement itself. You may screen on clearance directly, and you may restrict to US citizens only where a contract requires it.

An employer may restrict hiring to US citizens only when a law, regulation, executive order, or government contract requires it to do so. If the role requires a clearance, you can state that in the posting, and an applicant who cannot show the appropriate level can be disqualified on that point specifically, as opposed to their citizenship or immigration status. That distinction is the whole game.

The Immigration and Nationality Act's anti-discrimination provision, at 8 U.S.C. § 1324b, covers employers with four or more workers and prohibits four unfair practices: citizenship-status discrimination in hiring, firing, and recruitment; national-origin discrimination; unfair documentary practices; and retaliation. Citizenship status includes a person's immigration status.

The prohibited move is inference. Judging work authorization or national origin from a name, an accent, or an appearance is a violation, as is document abuse, meaning demanding specific or extra documents.

> **Rule:** Screen on clearance, never on national origin
>
> State the clearance requirement and the contract-required citizenship requirement, and screen on exactly those. Never infer work authorization or national origin from a name, accent, or appearance, and never demand documents before an offer.

The output of this stage is a one-line eligibility statement that names the clearance level and, where a contract requires it, the citizenship requirement, and infers nothing about national origin. Write it down before you source, so every downstream filter traces back to a lawful criterion.

## The public signals that imply a clearance

Five signal classes let you infer a clearance off a public profile: cleared contractor employer, military MOS, SCIF and facility language, agency or base co-location, and named programs or contract vehicles. Each proves something different, and each has a way of lying.

**Cleared contractor employer.** Booz Allen, Northrop Grumman, GDIT, KBR, ManTech, Raytheon BBN, SAIC, CACI, Battelle, BAE Systems, and MITRE run cleared programs out of the corridor. Employment at one raises the base rate. What it proves: the person worked somewhere that runs cleared programs. When it lies: these primes also employ large uncleared back-office and commercial staff, so a marketing manager at a prime is a false positive. Require a second signal.

**Military MOS.** The Army 35-series is near-deterministic. Every 35N holds a TS/SCI clearance. What it proves: eligibility was granted in service. When it lies: an MOS says nothing about whether the clearance is still inside the 24-month and 5-year window, so date the last cleared role, not the service date.

**SCIF and facility language.** Terms such as ICD 705 accreditation and ICD 503 indicate work inside a Sensitive Compartmented Information Facility. What it proves: proximity to SCI-level work. When it lies: the language can be aspirational or training-only.

**Agency or base co-location.** NSA, DISA, and USCYBERCOM at Fort Meade are strong location anchors. What it proves: the person worked near an intelligence installation. When it lies: on-site language can reflect an unescorted-visitor or Public Trust role rather than a collateral clearance, so look for ICD 705, SCI, or polygraph terms to separate the two.

**Named programs and contract vehicles.** A specific program or contract-vehicle name on a profile is hard to fake and often maps to a known classification level.

#### Signal confidence stack

1. **Military MOS** - Near-deterministic where it maps to a mandated level, such as Army 35N implying TS/SCI
2. **Program or contract-vehicle name** - Hard to fake and often maps to a known classification
3. **SCIF and polygraph language** - Strong when specific (ICD 705, SCI, full-scope poly), weak when generic
4. **Cleared contractor employer** - Raises the base rate but needs a second signal

*Deterministic proxies sit at the top; base-rate-raisers sit at the bottom and need corroboration.*

The rule that holds all of this together: no single signal is proof. One signal gives you a lead, two corroborating signals give you a candidate you can tag with confidence.

> **Watch out:** One prime on a profile is not a clearance
>
> A cleared employer also pays uncleared commercial and back-office staff. If a profile shows nothing but "works at Leidos," you have a base rate, not a clearance. Require a second signal (program, SCIF, MOS, or polygraph) before you tag a level.

## Geography does the first cut for you

Cleared work is physically concentrated, so a location filter removes most false positives before you score a single signal. Anchor your search to the metros where the work actually happens.

The Washington DC, Maryland, and Virginia region is home to more cleared professionals, more defense contractors, and more intelligence community work than any other metro area in the United States. The anchors are Washington DC (Pentagon, DIA, CIA), Northern Virginia (Arlington, Chantilly, Alexandria), the Maryland NSA corridor (Fort Meade, Annapolis Junction, Linthicum, Hanover), and Huntsville, Alabama (Redstone Arsenal). Chantilly alone reportedly had over 2,000 cleared openings, and Fort Meade over 1,800.

| Metro | Avg cleared salary | Primary installations/agencies |
| --- | --- | --- |
| Northern Virginia | $131,612 | Pentagon, contractors |
| Maryland (Fort Meade) | $130,878 | NSA, DISA, USCYBERCOM |
| Washington DC | $127,875 | DIA, CIA |
| Huntsville AL | $110,361 | Redstone Arsenal |

Northern Virginia pays roughly 19% above Huntsville, which matters when you calibrate an offer. For sourcing, the point is simpler: filter to these metros and their satellite towns first, and most of the "marketing manager at a prime" false positives drop out before you ever score a signal.

I ran this search: `Find former Army 35N or 35F intelligence analysts now at defense contractors in the Fort Meade and Annapolis Junction area who left a cleared role in the last two years.` - [see the full result list](https://www.refolk.ai/s/hk3s3kmjhw).

*Returns candidates whose MOS implies TS/SCI, anchored to the NSA corridor and already filtered to the under-24-month reactivation window.*

This is the step where a plain-English search engine saves the most time. Instead of stitching together boolean strings for every prime, MOS code, and town, you can state the signal combination and the recency window in one sentence. [Refolk](/) runs that query against the public GitHub graph, public LinkedIn records, and the open web at once, which is where these signals are actually scattered.

## Reactivatable eligibility is the variable that matters most

A clearance you cannot restore quickly is worth little, so the most predictive variable on your shortlist is not clearance age but months since the candidate's last cleared role. Score every candidate against the 24-month lapse window.

Two conditions must both hold to reactivate. Clearances can be reactivated by the same or a different agency if fewer than 24 months have elapsed since the eligibility terminated, the underlying investigation or continuous evaluation enrollment date is under 5 years old, and no new disqualifying information has surfaced. The regulatory basis is the NISPOM rule at 32 CFR Part 117, which states a contractor may restore access later without further investigation as long as the person remains eligible, the investigation is still current, and no new derogatory information has appeared (32 CFR 117.10(i)).

Why not just use the clearance's age? Because the fixed reinvestigation calendar no longer exists. On October 1, 2021, DCSA reported it had enrolled every DoD clearance holder in Continuous Vetting, replacing the every-five-to-ten-year reinvestigation. Historically, Periodic Security Investigations went out of date after 5, 10, or 15 years for Top Secret, Secret, and Confidential. Under Trusted Workforce 2.0 these converged, and all PSIs and continuous evaluation records now go out of date after five years. Crucially, this change did not touch the lapse clock: the 24-month reactivation window still applies.

> The fixed reinvestigation calendar is gone, but the 24-month lapse clock is not, so recency beats clearance math.

So score recency against the last date in a cleared role, with three bands:

- **Green:** last cleared role within 24 months. Reactivatable now.
- **Amber:** 24 months to roughly 5 years. The investigation currency may still hold, but access must be re-established, which is slower and less certain.
- **Red:** older than that. Treat as a fresh investigation, which changes the cost and timeline entirely.

The economics make the green window valuable rather than merely convenient.

| Level | Reactivation cost | Avg reactivation time | New-investigation currency |
| --- | --- | --- | --- |
| Secret | $420 | 138 days | 5 yrs (post TW2.0) |
| Top Secret | $5,410 | 249 days | 5 yrs (post TW2.0) |

A Top Secret reactivation reportedly costs about 12.9 times a Secret and takes about 1.8 times as long. A green-window candidate is structurally cheaper and faster to onboard than a fresh investigation, which is the mechanism behind cleared-talent wage premiums. That is also why recency deserves its own column on your shortlist, not a footnote.

## The procedure, start to finish

Run these seven steps in order. The timings assume a single sourcer working one role, and each step names what "done" looks like so you do not drift.

#### Cleared shortlist procedure

1. **Define the lawful filter** - Confirm whether the contract requires US-citizen-only status and which level and polygraph apply, then write a one-line eligibility statement that screens on clearance and contract-required citizenship only. Recruiter or hiring manager, 30 to 60 minutes.
2. **Build the signal dictionary** - List cleared employers, MOS and rate codes, program names, and SCIF terms for the relevant agency corridor, and weight each by how deterministic it is. Sourcer, 1 to 2 hours. Done is a scored keyword set per signal class.
3. **Source on public platforms** - Query GitHub, LinkedIn, and the open web for signal combinations, anchored to the metros that concentrate cleared work. Sourcer, 2 to 4 hours. Done is a raw pool of 100 to 300 candidates.
4. **Infer level and type** - Map each candidate's strongest signals to a likely level, using MOS as a near-deterministic proxy where present, and record a confidence band. Sourcer, 2 to 3 hours. Done is every candidate tagged with inferred level and confidence.
5. **Score reactivatable eligibility** - Date the last cleared role and flag green within 24 months, amber from 24 months to about 5 years, red if older. Sourcer, 1 to 2 hours. Done is a recency column per candidate.
6. **Rank and dedupe** - Combine level-fit, recency, and location into one score and remove duplicate profiles. Sourcer, 1 hour. Done is an ordered shortlist of 20 to 40.
7. **Lawful outreach and self-verification** - Ask candidates to confirm their own clearance status in their own words, and never demand documents before an offer. Recruiter, ongoing. Done is candidate-confirmed status on the top names.

There is a real order dispute worth naming. Some practitioners score recency (step 5) before inferring level (step 4), on the logic that a clearance lapsed beyond 24 months is disqualifying regardless of level, so dating the last cleared role first lets you cut red candidates before spending effort on a careful level read. Both orders are defensible. If your pool is large and your role is recency-sensitive, score recency first to shrink the set; if your role is level-sensitive and your pool is already small, infer level first.

#### From raw pool to confirmed shortlist

| Stage | Figure | Note |
| --- | --- | --- |
| Raw signal pool | 100-300 | One or more public signals |
| Two-signal candidates | shortlist input | Corroborated, level inferred |
| Green and amber recency | ranked | Inside or near the reactivation window |
| Confirmed shortlist | 20-40 | Candidate self-confirmed status |

*Each stage narrows the pool, and self-verification confirms what inference could only suggest.*

A word on outreach. Inference gets you a ranked list of likely clearance holders; it does not get you certainty. The only honest resolution is the candidate's own statement. Ask them to confirm their clearance status in their own words, and treat that self-confirmation as the thing that turns an inferred tag into a shortlist entry you can defend.

**Self-verification outreach line**

```
I'm working a [level] cleared role on [program or mission area] in the [metro] area. Before we go further, can you confirm your current clearance status in your own words, including level and whether you're inside the reactivation window from your last cleared position? No documents needed at this stage.
```

*Append to a normal role pitch. Keep it to self-confirmation; do not request documents.*

## How this goes wrong

Cleared sourcing fails in predictable ways, and every failure is a signal that was trusted past what it proves. Here are the seven to screen for, each with the check that catches it.

**Employer signal over-counts.** A cleared prime also employs uncleared commercial staff, so a marketing manager at a prime reads as a false positive. Check: require a second signal (program, SCIF, or MOS) before tagging a level.

**MOS implies eligibility, not currency.** A 35N who left service three years ago is red on the 24-month gate despite a deterministic MOS. Check: date the last cleared role, not the service date.

**Scoring against reinvestigation cycles that no longer exist.** Post-TW2.0 the fixed 5 and 10-year clock is gone, so penalizing a 4-year-old Top Secret is simply wrong. Check: score against the 24-month lapse window only.

**Citizenship inference from name or accent.** Screening out a work-authorized naturalized citizen on the basis of a name is both a bad read and a legal violation. Check: filter on clearance and contract-required citizenship only, never on national origin.

**Confusing Public Trust with collateral clearance.** On-site-at-NSA language can mean an escorted-visitor or Public Trust role rather than a cleared one. Check: look for ICD 705, SCI, or polygraph terms before you tag SCI-level access.

**Treating "active" as permanent.** The instant someone leaves a cleared position, access is administratively terminated and the clearance becomes current rather than active. Eligibility stays on file, but the person is no longer accessing classified work, so a current-looking profile may already be lapsed. Check: candidate self-confirmation at outreach.

**Confidential-level stale data.** The old 15-year Confidential currency is superseded by the uniform 5-year rule, so leaning on old tiers overstates reactivatability. Check: apply the 5-year currency uniformly across levels.

> **Tip:** The two-signal rule kills most false positives cheaply
>
> Nearly every failure mode above is defeated by the same discipline: never promote a candidate on one signal. Employer plus program, or MOS plus a dated cleared role, resolves the over-count, the currency gap, and the Public Trust confusion in one move.

## Before you call the shortlist done

Run this checklist against the finished list. It is the difference between a ranked set of inferences and a shortlist you can stand behind in a hiring review.

#### Shortlist readiness check

- [ ] The posting and filter screen on clearance and contract-required citizenship only, with no national-origin inference anywhere in the logic.
- [ ] Every candidate carries at least two corroborating signals before a level is tagged.
- [ ] Each inferred level has a recorded confidence band, and MOS-derived levels are marked as near-deterministic where they apply.
- [ ] Every candidate has a recency flag scored against the 24-month lapse window, not against a retired reinvestigation cycle.
- [ ] Confidential, Secret, and Top Secret candidates all have the uniform 5-year investigation currency applied.
- [ ] The ranking combines level-fit, recency, and location, and duplicates across platforms are merged.
- [ ] Top names have been asked to self-confirm clearance status, and no documents were requested before an offer.

## Keeping the read current

The signals and the law both move, so re-derive the thin parts rather than trusting a cached number. Two things in particular are mechanisms, not constants, and you should re-check them whenever you open this playbook.

First, the vetting infrastructure keeps changing. DCSA now conducts about 95% of federal background investigations for 140-plus agencies, and roughly 3.8 million people in the national security population were enrolled in Continuous Vetting as of September 2024. The intake system itself moved, with NBIS and eApp replacing legacy e-QIP in December 2024. None of these change the sourcing method, but they change how quickly a confirmed candidate can move once you hand them off, so verify the current process with your facility security officer rather than quoting a figure.

Second, the demand signal shifts with the budget. The FY2026 national defense budget reached $1.01 trillion, a 13% rise over FY2025, and the Washington-Baltimore-Arlington GS locality adjustment sits at 33.94% for 2026. When demand rises, green-window candidates get scarcer and the reactivation cost arbitrage gets more valuable, which is a reason to re-run your recency scoring often rather than once.

The durable parts of this method are the ones to lean on: level is hidden but MOS is not, recency beats reinvestigation math, geography compresses the search space, and the legal line is clean if you screen on clearance rather than citizenship. Build on those, corroborate every signal with a second, and let the candidate's own words close the loop.

## Frequently asked questions

### Can you legally ask a candidate about their security clearance?

Yes. If a job requires a security clearance you can state it in the posting and disqualify applicants who cannot show the appropriate level on that point specifically, as opposed to their citizenship or immigration status. You can also restrict to US citizens only where a law, regulation, executive order, or government contract requires it. The risk lies in inferring national origin or work authorization from a name, accent, or appearance, not in the clearance requirement itself.

### How do you infer clearance level from a public profile when nobody states it?

Read it off proxy signals. Military MOS is near-deterministic, so an Army 35N implies TS/SCI. A cleared contractor employer plus a second signal such as a SCIF reference, ICD 705 language, a program name, or a polygraph indicator raises confidence. Agency co-location at Fort Meade or Chantilly narrows it further. No single signal is proof, so require at least two before you tag a level with confidence.

### How long does a clearance stay reactivatable after someone leaves a cleared role?

Two conditions must both hold. Fewer than 24 months must have elapsed since the eligibility terminated, and the underlying investigation or continuous evaluation enrollment must be under 5 years old, with no new disqualifying information. The NISPOM rule at 32 CFR 117.10(i) allows restoring access without further investigation when those hold. Score candidates against the 24-month window, because the fixed reinvestigation calendar no longer exists.

### Do I need a paid cleared-talent database to source cleared candidates?

No. The population is not self-tagged, which is why explicit-level searches collapse to single-digit results, but it is readable from public signals: contractor employer, program and contract names, SCIF and base locations, military MOS, and recency against the 24-month window. A location filter anchored to the DMV corridor and Huntsville plus two corroborating signals produces a workable pool from open-web sources without a seat on a paid board.

### Why score recency against 24 months instead of the clearance's age?

Because Trusted Workforce 2.0 retired the fixed 5 and 10-year reinvestigation cycles and enrolled the population in Continuous Vetting, so penalizing a 4-year-old Top Secret for being old is wrong. The lapse clock is unchanged: a clearance becomes hard to restore once more than 24 months have passed since the last cleared role. Months since last cleared role is therefore the most predictive reactivatability variable.

---

*From the Refolk guide library. I revise these guides rather than replacing them, so the current version is always at https://www.refolk.ai/guides/sourcing-cleared-candidates-public-signals*