How to Find a Hiring Manager's Email Address (2026)

You find a hiring manager's email by looking it up in a data source first and guessing from a name pattern only when the lookup is empty. A lookup returns an address someone has already tested. A guess is a coin flip you must verify.

"Hiring manager" is a role in a hiring process, not a standard job title. It is the person who owns the open seat, usually a department head or team lead, and sometimes a recruiter or talent acquisition manager. So you search two ways: by the title "Hiring Manager" for people who carry it, and by the function and level of whoever owns the role you care about.

The address comes from four places. A data provider holds a work address it collected and tested. A company site or job post lists a shared inbox such as jobs@acme.com, which is not the manager's own. A name pattern gives you a guess. A personal address sits in some records but suits business outreach poorly.

Only the first is worth building a process around. This guide follows that ranking and uses the LeadOcean API, so every step has a request you can run.

TL;DR

• It takes about 15 minutes to size the audience, find one hiring manager and check the address status.
• The walkthrough spends about 4 records: up to 3 from the search and 1 from the reveal. Counts are free.
• Send only to verified, catch_all_valid or catch_all. Anything you guessed gets verified first.

Prerequisites

• A LeadOcean API key from app.leadocean.io. The free plan has 1,000 records, one-off, and no card.
• The key in your shell as $LEADOCEAN_API_KEY.
• curl and jq.
• A target company domain. The examples use acme.com.

export LEADOCEAN_API_KEY="paste-your-key-here"

Step 1: Size the hiring manager audience for free

Count how many hiring managers you can mail before you spend a record. Send count=true and limit=1 as query parameters. Arrays go comma-separated.

curl -s -G https://api.leadocean.io/v1/people/search \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  --data-urlencode "title=Hiring Manager" \
  --data-urlencode "jobLevel=Manager" \
  --data-urlencode "salesRegion=EMEA" \
  --data-urlencode "emailStatus=verified,catch_all_valid,catch_all" \
  --data-urlencode "count=true" \
  --data-urlencode "limit=1" | jq '.meta | {total, totalIsExact, countOnly}'

salesRegion takes NORAM, LATAM, EMEA or APAC. Swap in country=DE for one market. REST meta.total stops at 100,000, so a very wide filter can return a floor with totalIsExact false.

Step 2: Find the hiring manager at your target company

Search by company domain and title. The search returns a thin row with no address in it. The row carries a person_id and flags that say whether we hold an email.

curl -s https://api.leadocean.io/v1/people/search \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "domain": ["acme.com"],
    "title": ["Hiring Manager"],
    "jobLevel": ["Manager"],
    "limit": 3
  }' | jq '.data[] | {person_id: .meta.source_ids.person_id, contact_data}'

Each person returned costs 1 record. Keep limit small. Title values are keywords, so a few rows may carry a neighbouring title such as Senior Hiring Manager. Read the title before you pick one.

Few people list "Hiring Manager" as their job. When the search is thin, find the person who owns the seat. For an engineering hire, filter on function and level instead: "jobFunction": ["Engineering"] with "jobLevel": ["Manager", "Director"]. For recruiter-led searches, try "title": ["Talent Acquisition Manager", "Recruiting Manager"]. Size each with count=true first, and call leadocean_list_enum_values for the exact function string.

Step 3: Reveal the address

Send the person_id to enrich with reveal_email set to true. Enrich takes exactly one of linkedin_url, email, phone or person_id. There is no name plus domain lookup, which is why Step 2 comes first.

curl -s https://api.leadocean.io/v1/people/enrich \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"person_id": "PERSON_ID_FROM_STEP_2", "reveal_email": true}' \
  | jq '.data.contact_data | {email_status, contact_emails}'

This costs 1 record. A person we hold nothing for is a 404 and costs nothing. For a deliverable work address only, GET /v2/people/email/work with the same person_id returns one current-employer address or null. It costs 1 record per call, even when it finds nothing.

Step 4: Read the status before you send

The status says how far to trust the address. verified was tested. catch_all_valid means we confirmed the mailbox on a domain that accepts everything. catch_all means the domain accepts everything and the mailbox is unproven.

curl -s https://api.leadocean.io/v1/people/enrich \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"person_id": "PERSON_ID_FROM_STEP_2", "reveal_email": true}' \
  | jq -r '.data.contact_data
    | select(.email_status | IN("verified","catch_all_valid","catch_all"))
    | .contact_emails[0].email'

Empty output means the status failed the filter. LeadOcean gives no refund for bounced emails, so this check is your only protection. Treat catch_all as sendable at low volume, not as proof.

Step 5: Fall back to a name pattern

When the data holds no address, build candidates from the manager's name and the company domain. Four shapes are common. Pick the one you can confirm from a known address at the same company.

first="jane"; last="doe"; domain="acme.com"
printf '%s\n' "$first@$domain" "$first.$last@$domain" "${first:0:1}$last@$domain" "${first:0:1}.$last@$domain"

A wrong guess adds a bounce to your domain and lands nowhere. Never send to a candidate you have not verified with an email verifier you trust. A domain that accepts all mail cannot confirm any single mailbox, so a guess there stays a guess.

What you get

Step 1 is free. We ran it on 2026-10-21 for each sales region with leadocean_count_leads. The counts are mailable people with the title Hiring Manager at job level Manager (verified, catch_all_valid or catch_all, the tool default), not everyone we hold. Titles match as keywords, so read a sample before you send.

The small numbers are the point. The literal title is rare, so most of your list comes from function and level, as in Step 2. In NORAM, 1,479 of the 1,530 sit in the US.

A revealed person comes back in the shape below. This is the response shape from the API reference, with placeholder values.

{
  "success": true,
  "data": {
    "profile_data": { "...": "name, title, company" },
    "contact_data": {
      "has_email": true,
      "email_status": "verified",
      "email_type": "work",
      "contact_emails": [
        { "email": "jane.doe@acme.com", "type": "work", "status": "verified" }
      ]
    }
  }
}

Troubleshooting

FAQ