Your Vacancy Just Named Your Firewall: A Twenty-Minute Job Ad Scrub

There's a genre of job advert that reads less like a role description and more like a wiring diagram. You know the one. "Reporting to the IT Manager, you'll administer our Sophos XGS firewalls, manage Mimecast, support the migration to SharePoint Online, and act as escalation point for the finance team's Sage and Xero instances. Experience of Veeam essential." Somewhere in there is a perfectly good job. There's also a stranger's to-do list.

Small teams write ads like this because it's honest and it's quick. You want someone who can hit the ground running, so you list the kit. Nobody in a five-person IT function has time to be coy about product names when the vacancy has been open since August. Fair enough. But the ad isn't a private document handed to shortlisted candidates — it's a public page, indexed, scraped, syndicated to aggregators, and copied into WhatsApp groups of contractors within about forty minutes.

What a vacancy actually gives away

Think about what a well-aimed phishing email needs. Not much: a plausible sender, a system name you recognise, a bit of urgency, and the sense that the recipient is the right person to panic. A job ad can supply most of that in a couple of paragraphs.

Here's what tends to leak out of a small organisation's recruitment posts:

• The stack, by brand. Firewall vendor, email security, backup product, cloud provider, finance package, ticketing system, MDM. Sometimes with version numbers if the ad mentions a migration.
• Who owns what. "You will be the sole administrator for our Azure tenancy" is a sentence about a person's role. It's also a sentence about a single point of failure.
• How stretched you are. "You'll join a team of two supporting 180 users" is a retention pitch and a response-time estimate in one.
• Projects mid-flight. Migrations, rollouts, consolidations. Anything with a go-live date attached is a window where things are messy and logins are being reissued.
• The gaps. "MFA rollout ongoing" or "we're moving to a new backup provider next year" tells a reader precisely where the seams are.
• Org chart fragments. Reporting lines, who signs off, which team sits where.

None of this is secret in the sense of being classified. It's just public, permanent, and easy to read in bulk. That's the problem.

Why a shopping list beats a name badge

Generic phishing is cheap and mostly ignored. A message that says "we're updating access ahead of the SharePoint migration, please reauthenticate" lands very differently — partly because it's specific, but mostly because it's plausible. Specificity is the thing that gets a busy person to click at 4:40pm on a Friday.

Knowing the stack also shapes which fake login page gets built. Any decent phishing kit imitates a generic Microsoft sign-in; a kit that imitates the admin console you actually use is a different proposition. And knowing that there are two of you, one of whom is on leave, tells an attacker how long they can sit quietly in an inbox before anyone notices.

The twenty-minute scrub

Set a timer. Open a browser. This is genuinely all you need — no subscription, no consultant.

Minutes 1–5: collect what's live. Search your organisation's name on Indeed, Reed, LinkedIn and your own careers page. Dig out agency ads you didn't write (they often copy your copy, and paste in the bits you removed). Check any "we're hiring" posts on social. Save each one as a PDF — not because you'll need it later, but because editing forces you to read.

Minutes 5–10: read as a stranger with a notepad. Go through and write down every proper noun, every system owner, every future tense. Don't judge yet, just list. Most teams find between fifteen and thirty items in a single ad.

Minutes 10–15: apply the so-what test. For each item, ask one question: would knowing this make a phishing email more convincing? Brand names usually score high. "Competitive pension" scores zero. Be ruthless with anything that names a system and a person and a moment in time — that combination is the valuable one.

Minutes 15–20: rewrite the worst offender while the tab is open. Not the whole careers page. Just the ad with the most leaking in it. You'll be surprised how little you lose.

Rewriting without going vague

The trap is over-correcting into "you'll support our various IT systems", which tells a good candidate nothing and wastes everyone's time. The aim isn't mystery. It's this: a serious applicant should be able to picture the job; a passing stranger shouldn't be able to picture the network.

A few swaps that work:

• Category instead of brand. "An enterprise email security platform" and "a mainstream cloud productivity suite" still signal the level of experience you want.
• Capability instead of console. "You've run MFA for a few hundred users" is more useful to a candidate than a product name they've never touched.
• Ownership without the map. "You'll be the go-to person for our finance systems" rather than naming the accounting package and the three subscriptions feeding it.
• Projects without the schedule. "You'll support an ongoing cloud migration" is fine. "We go live in March and it's behind" belongs in the interview, not the advert.
• No version numbers. Ever. They date the ad and date your defences at the same time.

One judgement call: the line about having no dedicated security person. It's honest, it's generous to candidates, and it's exactly the sort of thing an attacker likes to hear. You don't have to remove it — plenty of good hires have been won by that sentence — but if you keep it, don't also publish the stack. One or the other.

The bits people forget

Agency briefs, recruiter messages on LinkedIn, posts in local business groups, Glassdoor comments, staff bios on your own site, and anything written for a tender. Also worth remembering: deleting an ad doesn't unpublish it. Aggregators cache, archives copy, and someone has already saved it. Edit the live version to fix it going forward and assume the older copy is out there.

Where to stop

You can't recruit a firewall administrator without mentioning firewalls, and you shouldn't try. The realistic goal is to cut the reconnaissance value by half while keeping the ad readable — which, in practice, means removing the brand names, the org chart fragments, and the sentences that describe how thinly stretched you are.

Nobody is going to audit your recruitment posts for you. There's no certification, no insurer questionnaire, no tick box. It's just twenty minutes, a cup of tea, and the slightly uncomfortable experience of reading your own advert the way a stranger would.