Job board roles and shared logins

When several people work in one job board account, you decide three things. Can each person get their own user? Which role does each one get? And what do you do when someone leaves or changes jobs? The answers depend on the board, so the table below sets out what each board’s own help pages say. The wider picture for HR accounts is in Managing HR and recruiting accounts.

How the boards compare

Each board also limits who can change users. On Indeed, admins add and remove users. Indeed’s custom User Management permission lets someone else add users too, but they can grant only “the same or lower access” than their own. On Glassdoor, an Administrator manages users, while a Local Administrator manages them only for certain country profiles. A Content Manager gets every feature except managing users. On a LinkedIn Page, a super admin can add and remove any type of admin.

Choosing a role

Give each person the access their work needs and nothing more. That is the least-privilege principle in NIST SP 800-53, the federal catalog of security controls. Its control AC-6 allows “only authorized accesses” that users need to do their assigned tasks. For businesses the CCPA covers, the names and contact details of applicants who live in California are personal information under that law. Which US rules apply is in the pillar linked above.

On Indeed, the way to limit whose data a person sees is the job. Limited access lets someone review and message candidates, use screening and set up interviews only for specific jobs. That fits hiring managers and interviewers who work on one opening. A custom role can pair the Candidates permission at the Limited level with other permissions, such as posting jobs.

On ZipRecruiter, an Account Owner has every feature. To narrow someone’s access, an admin opens their profile and clears the Account Owner box under Access Settings. The person becomes a Restricted User, and the admin then turns individual permissions on or off.

Glassdoor’s roles divide who manages users, content and analytics. Content Manager covers every feature except users, and Analytics Only gives view-only access to analytics. Give Administrator only to the people who add and remove others.

LinkedIn has no role for a job post. The member who posted it sees the applicants. They can share an applicant’s profile in a message with coworkers who are 1st-degree connections, but those coworkers can’t rate applicants or add notes. A hiring manager who needs the full applicant list has to post the job from their own account.

When the account has only one login

Some boards and portals give the whole team one login. LinkedIn rules out a shared recruiting profile. A job must come from a profile with a person’s real name, “and not a company’s name.”

Where one login is shared, the board can’t tell people apart. NIST control IA-2 asks you to uniquely identify and authenticate each user, and a shared login gives one identity to everyone who knows the password. Its history shows the account name, not the person.

So you keep three things outside the board. First, a list of who may use the login. Second, a record of who used it and when. Third, a password change whenever someone on the list leaves, which NIST control AC-2 asks for in item k. How to set these up is in When shared accounts can’t be split into personal ones. If changing and resending the password gets old, Comparing ways for several people to use one shared account sets out the alternatives.

Before someone leaves or changes roles

Most of the work is the removal step in the table. A few boards need something done first.

LinkedIn Pages must keep at least one super admin. If the person leaving is the only one, they have to assign another super admin before they can remove themselves.

Applicants on a LinkedIn job post stay with the poster. A post can’t be deleted, and once closed it can’t be reopened. LinkedIn also closes posts on its own after six months. So decide who posts each job before someone hands in notice, and have them close posts for filled roles.

Indeed sends removed users no notice. Tell the person, or their manager, that access has ended, so nobody keeps trying to sign in.

The user list is how you confirm the removal on every board. Put each board on your exit checklist with the name of the person who removes access, and check the list on the last day. The full routine is in the Account checklist for onboarding and offboarding employees.