How to Find an IT Director's Email Address (2026)

You find an IT Director's email by looking it up in a data source first and guessing from a name pattern only when the lookup is empty. A lookup returns an address someone has already checked. A guess is a coin flip that you must verify.

IT Director addresses come from four places. A data provider holds a work address it collected and tested. A company site lists a shared inbox such as it@ or helpdesk@, which rarely reaches the director. A name pattern gives you a guess. A personal address sits in some records but suits business outreach poorly.

Only the first is worth building a process around. This guide follows that ranking.

IT Directors have a title problem. The same job shows up as Director of IT, IT Director, Director of Information Technology or Head of IT. Filter on job function and level, not on one title string. Step 1 sizes the audience before you spend anything.

Every step below has a request you can run against the LeadOcean API.

TL;DR

• It takes about 15 minutes to size the audience, find one IT Director's address and check its status.
• The walkthrough spends about 4 records: up to 3 from the search and 1 from the reveal. Counts are free.
• Send only to verified, catch_all_valid or catch_all. Verify any address you guessed first.

Prerequisites

• A LeadOcean API key from app.leadocean.io. The free plan has 1,000 records, one-off, and no card.
• The key in your shell as $LEADOCEAN_API_KEY.
• curl and jq.
• A target company domain. The examples use acme.com.

export LEADOCEAN_API_KEY="paste-your-key-here"

Step 1: Size the IT Director audience for free

Count how many IT Directors you can mail before you spend a record. Send count=true and limit=1 as query parameters. Arrays go comma-separated.

curl -s -G https://api.leadocean.io/v1/people/search \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  --data-urlencode "jobFunction=Information Technology" \
  --data-urlencode "jobLevel=Director" \
  --data-urlencode "salesRegion=EMEA" \
  --data-urlencode "emailStatus=verified,catch_all_valid,catch_all" \
  --data-urlencode "count=true" \
  --data-urlencode "limit=1" | jq '.meta | {total, totalIsExact, countOnly}'

salesRegion takes NORAM, LATAM, EMEA or APAC. Swap in country=DE for one market. REST meta.total stops at 100,000, so a big region can come back as a floor with totalIsExact false.

Step 2: Find the IT Director at your target company

Search by company domain, function and level. The search returns a thin row with no address in it. The row carries a person_id and flags that say whether we hold an email.

curl -s https://api.leadocean.io/v1/people/search \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "domain": ["acme.com"],
    "jobFunction": ["Information Technology"],
    "jobLevel": ["Director"],
    "limit": 3
  }' | jq '.data[] | {person_id: .meta.source_ids.person_id, contact_data}'

Each person returned costs 1 record. Keep limit small. A large company can have a dozen IT Directors, one per area such as infrastructure, security or applications. Read the title before you pick one.

To target one area, add a title keyword such as "title": ["Director of IT Infrastructure"]. Title values are keywords, so a few rows may carry a neighbouring title.

Step 3: Reveal the address

Send the person_id to enrich with reveal_email set to true. Enrich takes exactly one of linkedin_url, email, phone or person_id. There is no name plus domain lookup, which is why Step 2 comes first.

curl -s https://api.leadocean.io/v1/people/enrich \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"person_id": "PERSON_ID_FROM_STEP_2", "reveal_email": true}' \
  | jq '.data.contact_data | {email_status, contact_emails}'

This costs 1 record. A person we hold nothing for is a 404 and costs nothing. If you only want a deliverable work address, GET /v2/people/email/work with the same person_id returns one current-employer address or null. It costs 1 record per call, even when it finds nothing.

Step 4: Read the status before you send

The status says how far to trust the address. verified was tested. catch_all_valid means we confirmed the mailbox on a domain that accepts everything. catch_all means the domain accepts everything and the mailbox is unproven.

curl -s https://api.leadocean.io/v1/people/enrich \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"person_id": "PERSON_ID_FROM_STEP_2", "reveal_email": true}' \
  | jq -r '.data.contact_data
    | select(.email_status | IN("verified","catch_all_valid","catch_all"))
    | .contact_emails[0].email'

Empty output means the status failed the filter. LeadOcean gives no refund for bounced emails, so this check is your only protection. Treat catch_all as sendable at low volume, not as proof.

Step 5: Fall back to a name pattern

When the data holds no address, build candidates from the director's name and the company domain. Most companies use one of four shapes. Pick the one you can confirm from a known address at the same company.

first="jane"; last="doe"; domain="acme.com"
printf '%s\n' "$first@$domain" "$first.$last@$domain" "${first:0:1}$last@$domain" "${first:0:1}.$last@$domain"

Guessing is the weakest route for an IT Director. IT teams run the mail filters, so a bad guess lands in a system the reader controls and can see. Never send to a candidate you have not verified. Run each one through an email verifier you trust first. A domain that accepts all mail cannot confirm any single mailbox, so a guess there stays a guess.

What you get

Step 1 is free. We ran it on 2026-10-21 for each sales region with leadocean_count_leads. The counts are mailable IT Directors (verified, catch_all_valid or catch_all, the tool default), not every IT Director we hold. The filter is job function Information Technology with job level Director. It matches the role by function and level, not by title text, so read a sample before you send.

A revealed person comes back in the shape below. This is the response shape from the API reference, with placeholder values.

{
  "success": true,
  "data": {
    "profile_data": { "...": "name, title, company" },
    "contact_data": {
      "has_email": true,
      "email_status": "verified",
      "email_type": "work",
      "contact_emails": [
        { "email": "jane.doe@acme.com", "type": "work", "status": "verified" }
      ]
    }
  }
}

Troubleshooting

FAQ