Got this right for exporting a new password based on the last 4 of social as related to information directly in the system:

<quer:projection alias="NewPassword" xmlns:quer="http://www.taleo.com/ws/integration/query">
  <quer:concatenate>
    <quer:string>Taleo</quer:string>
    <quer:substring>
      <quer:toChar>
        <quer:customFunction name="REGEXP_REPLACE">
          <quer:field path="Candidate,SocialSecurityNumber"/>
          <quer:string>[^[:digit:]]</quer:string>
          <quer:string/>
        </quer:customFunction>
      </quer:toChar>
      <quer:integer>6</quer:integer>
      <quer:integer>4</quer:integer>
    </quer:substring>
  </quer:concatenate>
</quer:projection>