alt Hacker NewsYou don't need someone who knows those two lines anymore. You can just ask codex to make it so that users can't do whatever. It's highly competent at just reading the nixpkgs source, or it knows how Linux works and can write its own modules.
Nix happens to also set you up with a working build environment so if a program doesn't expose the necessary options to manage it the way you want, I bet Codex would have no trouble patching it as part of your nix config.
You still need to have somebody half competent to ask the electric shaitan to the thing and validate the result and also demonstrate this ability during the hiring process. I'm not sure it's easier than actually finding a person who can do those two lines.