500 applicants.
5 interviews.
The problem isn't the pool.
When a cyber security req sits open for months, everyone audits the applicants. OdysseyHires audits the job description — measuring every requirement against the people who actually applied, and naming the ones quietly removing candidates who could do the job.
Requisition analysis
REQ-4471Senior Compliance Analyst · 500 applicants · 118 days open
Everyone is asking the wrong question
Recruiters are handed requirements and told to filter. Nobody in the chain owns the question of whether the requirements can be met at all.
What's wrong with my applicant pool?
This question has an unlimited supply of answers, and none of them are testable. The market is tight. Sourcing is weak. Comp is off. Candidates today don't have the depth. So the req stays open, the pipeline gets rebuilt, and the same five people reach interview.
It assumes the job description is correct and the world is wrong.
Is my job description a reflection of my applicant pool?
This one is answerable. You have the requirements in writing and you have the people who applied. Every requirement can be measured against that pool, and the count of who clears it is a fact, not an opinion.
When a requirement removes 100% of applicants, that isn't a market problem. It's a problem with the job description.
Three ways a requisition blocks itself
Each one is invisible from inside the hiring process, and each one is arithmetic once you look.
Nobody on earth qualifies
The requirement asks for more years of experience than the technology, framework, or certification has existed. No applicant pool is needed to prove it — only a publication date. These requirements survive because the person screening for them has no reason to know when the standard was written.
10+ years with a certification released six years ago.
Satisfiable, but not by anyone here
The requirement is achievable in principle and zero people in your 500 have it. That's a fact about your sourcing channels, your comp band, and your location — and it stays hidden as long as the requirement is treated as non-negotiable rather than as a cost with a number attached.
A niche OT protocol stack, on-site, in a low-density labor market.
Every requirement is fine. The stack isn't.
Each line is defensible on its own. 71% clear the first, 34% the second, 22% the third. The intersection collapses toward zero in a way nobody estimates correctly. Whoever added the fifth bullet believed it cost a little. It cost everything.
Six reasonable requirements, zero people holding all six.
A finding, start to finish
Drawn from a real requisition encountered in customer discovery. Details are anonymized and the pool figures are illustrative.
10+ years experience with CMMC
Listed as a must-have by the hiring manager, alongside a set of otherwise reasonable requirements: five-plus years in IT, cyber, or GRC, and five-plus years with NIST 800-53 and ISO 27001.
CMMC was first published in January 2020. As of today the maximum experience any candidate can hold is 6.6 years. The requirement asks for 10.
No person qualifies. No person will qualify before 2030. Every applicant fails this line, including the ones who could do the job.
CMMC derives its control set from NIST 800-171, published in 2015. If the intent is familiarity with the underlying controls, that requirement is both satisfiable and measurable.
Substituting it returns 96 applicants to the pool who were previously removed by a single line.
Eleven candidates instead of zero — from correcting one line. The remaining drop from 96 to 11 is the second conversation: clearance and onsite are real constraints with a measurable price.
What you receive
A requirement-by-requirement report on the requisition. Every line gets a clearance count, a classification, and a recommendation you can forward without having to defend it yourself.
| Requirement | Level | Clears | Rate | Classification | Recommendation |
|---|---|---|---|---|---|
| 5+ years IT / cyber / GRCREQ-01 | Must | 355 / 500 | 71% | Reasonable | Keep as written |
| 5+ years NIST 800-53REQ-02 | Must | 170 / 500 | 34% | Reasonable | Keep as written |
| ISO 27001 experienceREQ-03 | Must | 205 / 500 | 41% | Reasonable | Keep as written |
| 10+ years CMMCREQ-04 | Must | 0 / 500 | 0% | Impossible | Replace with NIST 800-171 · returns 96 |
| Active Secret clearanceREQ-05 | Must | 110 / 500 | 22% | Restrictive | Consider clearable-eligible · returns 74 |
| Onsite 5 days, rural facilityREQ-06 | Must | 85 / 500 | 17% | Restrictive | Hybrid 3 days · returns 58 |
Scroll sideways to see all columns →
How the analysis runs
Fixed rules and explicit thresholds. Nothing here is a model opinion about a person.
Decompose the requisition
The job description is broken into discrete requirements, each with the thresholds it actually implies — years, depth of responsibility, scope of environment, and how recently the experience must have been used.
- Aliases resolved to a canonical entity, so 800-53 and NIST SP 800-53 count as one requirement
- Must, preferred, and nice-to-have kept distinct
- Every threshold traceable to the sentence it came from
Measure against the pool
Each requirement is evaluated against every applicant using deterministic rules — no embeddings, no similarity scores, no model producing a number. The output is a count of who clears, and the rule that decided it.
- Same inputs produce the same counts, every run
- Requirements measured individually and in sequence
- Cumulative attrition shown line by line
Classify and recommend
Requirements are checked against a curated reference of when each framework, certification, and technology was published, and what it derives from. Impossible lines are named with the date arithmetic, and a satisfiable substitute is proposed.
- Publication dates and framework lineage, versioned and citable
- Every recommendation carries the candidates it returns
- Written to be forwarded to the hiring manager as-is
We analyze requisitions, not people
OdysseyHires produces no ranking, score, or recommendation about any individual applicant. Resumes are read only to count how many people clear each requirement. The finding is always about the document.
- Not an applicant tracking system — it doesn't manage pipelines or schedule interviews
- Not a resume screener — no candidate is advanced, rejected, or ranked
- No similarity matching, embeddings, or fuzzy keyword scoring anywhere in the evaluation
- No model-generated numbers — an LLM extracts structure and writes prose, never a score
- Works alongside the ATS you already run, on requisitions you already have open
- Every count reproducible and traceable to the rule that produced it
Built for one hard market
Cyber security roles in critical infrastructure, where impossible requirement stacks are routine and a vacancy carries operational and regulatory weight.
Standing, without the domain argument
You were handed the requirements. You're expected to filter against them, not to know when CMMC was published or what it inherits from. Challenging a hiring manager on domain grounds is an argument you'd lose, so it doesn't happen.
This gives you a document instead of an argument. Not "this requirement seems unreasonable," but "this requirement removes 100% of applicants, here's the arithmetic, and here's the version that returns 96 of them."
A price tag on every requirement
Nobody writing a job description intends to make it unfillable. The fifth bullet felt like it cost a little. Without the pool arithmetic, there's no way to know it cost everything.
Each requirement gets a number attached. Keep the ones worth their price, and see exactly what the others are costing in candidates and in days the req stays open.
Bring us a req that won't close
Send one open cyber security requisition and the applicant pool it's collected. We'll walk you through what's blocking it, line by line.
One person replies within one business day. No sequence, no newsletter.
Prefer to write directly? demo@odysseyhires.com
Request received
Thanks — we'll reply within one business day. If it's urgent, write to demo@odysseyhires.com directly.