Needed this for a project and seemed to work pretty well for nesting operations.
<quer:projection alias="SSN2" xmlns:quer="http://www.taleo.com/ws/integration/query"> <quer:substring> <quer:toChar> <quer:customFunction name="REGEXP_REPLACE"> <quer:field path="Candidate,SocialSecurityNumber"/> <quer:string>[^[:digit:]]</quer:string> <quer:string/> </quer:customFunction> </quer:toChar> <quer:integer>6</quer:integer> <quer:integer>4</quer:integer> </quer:substring> </quer:projection>