I know some people don't put their resumes online on job-seeking services because they think it will cost them their job. How can I keep it confidential? Do I use a fake name? How do I list my experience? It is possible a corporate recruiter will come across it because my skill set is an exact match for my current company?
These days it is common and often expected to have an extensive LinkedIn profile with many connections.
No one that I know has ever been "in trouble" because their LinkedIn profile is online. There was one news story earlier this year where someone was supposedly fired because of their LinkedIn presence. However, it turns out that in this particular case, the individual had made critical statements about his employer (and that was the real problem).
The other sites such as Monster, Dice, and CareerBuilder are mostly vehicles for annoying recruiters and it is not worth it to make your information searchable on these sites. Instead just use them and "Indeed" to perform your own searches (if you can tolerate the noise level).
I would suspect the concern of retaliation has a lot to do with your particular circumstances. As a tech worker, I've had very little fear of this, and have posted my resume online numerous times in numerous channels. I've even talked to management I trusted about previous and even current job searches - because what I learn when searching can make the company I work for better.
Different industries, and different locations and different corporate cultures all play a factor here.
Things to consider regardless of industry:
how you balance the job search and your current work obligations is likely to be the biggest factor to loosing or keeping your current job. I've seen more issues raised when a person was missing many meetings, coming in late, leaving early, and clearly distracted all day due to a job search. It's inevitable that during a search you'll miss some work, but keep track of your schedule, do your best to keep it under control, and continue to pay attention to your deadlines at your current employer.
Don't lie on or obfuscate your resume - this is the first impression your future employer has of you... don't start off witha lie.
Consider each communication channel - recruiters, job search sites, public profiles, etc - what is your impression of your privacy, the potential for good job hits, and the cost of posting your information there - both to your reputation and in time. For example - I found most recruiters to be very high cost vs. value - because they took a lot of time to communicate with and turned up 0 matches. I found Stack Overflows Careers site to be relatively high value - as I got both an interview and a really interesting ping from it, for very little work. If you are really concerned, focus on venues where you apply for positions and can make your public profile private or let the service obfuscate it.
Know your company's recruiting mechanism. Most of the companies I've worked for a big organizations. HR does the browsing for candidates, not my manager. I'm less concerned if an HR person finds my resume, as they usually have better things to do than rat me out to my management.
Watch what you say about your current employer - whereever and whenever. It fits into the "don't be a jerk" rule. Regardless of whether you are talking to recruiters or other companies - have an impersonal, non-judgemental reason for leaving. You know never really know who knows who.
For the last several jobs, I've taken the tactic of 'never taking it offline'. I've never had a nasty employer, but so far it's done me no harm that I can see (I left JOB[-2] under good circumstances and JOB[-1] let me go during a downsize where several remote employees got the ax).
I don't personally use the Monster/Dice/etc sites, but my LinkedIn profile has been online across my last 3 or so jobs. Similarly, my CV is up on my website and on Careers.Stackoverflow.com.
I try to keep them up to date (I'm kind of bad at that), but by keeping them up and visible, your employer should have no cause to think you are doing anything odd.
In addition to Michael's advice:
Some of the major sites (Monster, etc.) can let you set your profile as "confidential". That way, only recruiters trying to contact you (or those you permit) will see your name.
Some sites let you set your resume as "not actively looking but open to offers". I doubt your boss would let that worry him.
If you're really worried, post your resume without your current job on it. Your boss will assume you never updated it.
Assuming that you have a need to keep it hidden, because you are new to the contract/company, or you are afraid of possible repercussions, the best approach would be to start slowly.
Get an account on LinkedIn, then over the next week or two post a very detailed history, almost a resume. Say it is to make it easier for old co-workers to find you.
Then start adding people you met at other events, including one or two recruiters. This will cause you to start appearing in searches. You still have plausible deniability. You should start to get emails from LinkedIn flagging jobs you might be interested in. Your contacts can also submit your resume to their company, they might get a bonus if you are hired.
Finally start posting on the resume sites. If asked by your boss, say you only filled out enough so you could look around for jobs in other parts of the US, because your spouse/significant other was talking about graduate school.
Don't use a fake name. It will be harder to explain to a potential employer that your name on the resume is fake.
Are you even sure your company uses that site. There are a lot of sites, nobody uses them all. You could ask HR which sites they use. Tell them it is for your brother.
Ultimately you are taking a risk, but you might not have a choice.