Trigger
Jeremy Epling introduces custom agents, skills, and end-to-end workflows at Vanta Delivers on September 10, 9 a.m. PT. The Director of Product Design posting is day 10 on Ashby. The Head of Design posting is day 60 and still open. Confidence on event timing: high — company-published page, named speakers, published schedule.
Window
Send September 10 or 11. After the event, Epling will have said specific things about agent delegation and trust in public, on the record, and you can open on those instead of on the posting. That advantage is short. By Monday the 14th the event is old news and your message reads like every other one in his inbox. The Director posting is early enough that the pipeline is probably still thin.
What this means for the design org
Epling's recent language shows where his attention sits. Five days ago on LinkedIn he described customers moving from "Can Vanta do this?" to "Can I build this into Vanta?" In a Benzinga interview he warned that rising automation produces "chaos and overwhelm." The event preview promises customers "delegating most of their work to AI agents" while needing "trusted data and context."
Those two statements frame the core design tension: customers want to build agents into Vanta, and that building produces chaos without the right controls. Vanta's help documentation shows that custom agents currently run with the creator's permissions, carry a single binary approval state ("Needs approval"), and expose no organization-wide admin view of what agents exist or what they've done. That's a thin governance surface for a company whose product is audit trails. The thicker version has to be designed by someone, and the Director of Product Design for Risk is the most likely candidate.
The prior battlecard named the open question: does this Director own acceptance thresholds, overrides, and escalation logic, or only the screens that display agent output? Nothing this week resolved it. Neither posting uses the words "permissions," "rollback," or "recovery," and the event preview doesn't mention control mechanisms at all. Probe it in the outreach. The answer separates a role that defines how customers grant and revoke agent authority from one that designs the configuration UI on top of decisions someone else makes.
Your angle
Lead with Carrier IQ and the Trust essay. Support with Alibaba.
Carrier IQ's approval and evidence surfaces line up against Vanta's documented assessment states — Draft, Needs review, Pending approval, Approved — and its sequential approval workflows, up to five steps with three approvers each. The Trust essay's five handoffs give you vocabulary for the problem Epling keeps circling in public: how customers hand work to agents without losing confidence in what comes back. Alibaba carries the enterprise-complexity weight. The Director posting describes connected workflows across risks, assets, vendors, controls, tasks, owners, approvals, and org hierarchy, which is the same multi-object, multi-stakeholder surface you redesigned at $50B+ GMV.
No published forward-looking artifact covers agent permissions, revocation, or recovery. If you can publish one interaction model for graduated delegation before September 10, it sharpens the outreach. If not, move with what you have — the event window is worth more than the artifact gap.
Competitive landscape
Three archetypes are likely in this pipeline. Confidence: moderate, inferred from role requirements rather than sourced.
- The GRC design leader from ServiceNow or OneTrust. Knows the compliance domain cold, has never designed trust surfaces for autonomous agents.
- The AI-native designer from an agent-builder startup. Technical fluency, no regulated multi-stakeholder workflow proof.
- The enterprise design director from Salesforce or Workday. Multi-object workflow experience, no published framework for human-agent delegation.
Carrier IQ plus Alibaba covers the ground each of them misses: live agentic trust surfaces alongside enterprise-scale workflow redesign. Your exposure is the absence of direct GRC experience. Preempt it by naming the structural parallel between compliance assessment workflows and the approval-gate patterns you've already designed. Don't perform domain knowledge you don't have — Epling will find the seam in ten minutes.
Who to contact
Jeremy Epling, CPO. LinkedIn. Named speaker at the September 10 event, and the most likely hiring authority for this Director role while the Head of Design seat is empty.
Public fingerprint: His most recent post asks what actually enables agents to deliver and introduces the Trust Graph — Vanta's term for the data layer their specialized agents draw from. He emphasized "real evals, full traceability" in a Trustcraft engineering series post about a month ago. In the Benzinga interview he described "security through obscurity" breaking down once agents can find data or act unexpectedly. He is thinking about control, not about builder capability in the abstract.
Warm path: None findable. This is cold, and the event is a better opening than most warm intros would give you.
Channel: LinkedIn DM, September 10 or 11.
Outreach messages
Warm message — use only if a mutual connection surfaces before the 10th:
"[Name] suggested I reach out. I built Carrier IQ (live at junochen.com), an agentic InsurTech tool where the human approval gate maps onto the same assessment workflow states as Vanta's Risk product. Would 20 minutes be useful to talk through how graduated delegation design applies to the Director role — and whether it owns the permissions and recovery layer or primarily the builder configuration surface?"
Cold message — send September 10 or 11:
"Your 'Can I build this into Vanta?' framing at today's event names the shift I've been designing for. I wrote 'Trust Is the New Interface' (junochen.com) as a framework for it — the five handoffs that determine whether someone watches, verifies, or delegates to an agent. Carrier IQ, also at junochen.com, is an agentic InsurTech tool I built solo where the human approval gate and evidence provenance are the product. Before that, at Alibaba.com ($50B+ GMV), I redesigned interconnected workflows where every object touched multiple stakeholders with different authority levels. Would 20 minutes on graduated delegation in Risk workflows be useful — specifically whether the Director role owns the trust and permissions layer or primarily the builder configuration surface?"
What not to say:
- Don't call Vanta a compliance tool. Epling is selling a platform.
- Don't raise the Head of Design vacancy in first contact. It reads as anxiety about reporting lines before you've talked about the work.
- Don't lead with TinyFish. It isn't published proof, and he will open junochen.com.
The non-obvious thing
Custom agents inherit the creator's permissions, and permission changes to the creator propagate to the agent. There is no documented org-wide admin view of which agents exist, what they've executed, or who built them. At a company selling auditability, that's a real hole, and it will land on whoever owns Risk workflows. If the Director owns it, the role is meaningfully bigger than the posting describes. Ask.
Warning signs
The Head of Design search is at day 60 with nothing visible moving. Deb Kawamoto left at the end of June; Jenny Chang left in July. Three directors remain — Kowitz, Larson, Sheehan. You would be joining a design org with no VP and no Head, reporting into an arrangement that hasn't been decided yet. The prior battlecard's warning still applies: whoever takes the Head role will redraw scope and reporting for every director under them.
That isn't a reason to skip it. The stretch before the Head hire is when you have the most room to shape the job. But get the interim structure on the table in the first substantive conversation, and frame it as scope rather than politics: "Who is the Director's primary partner on product and engineering leadership today?"
Cover letter draft
A customer-built agent proposes a change to a risk assessment. Three stakeholders have to approve it. One of them disagrees. That moment is the hardest design problem in Vanta's Risk area, and it's a trust surface — the kind I've spent the last three years designing across enterprise platforms and agentic AI.
Carrier IQ, live at junochen.com, is an agentic InsurTech tool I built solo where the human approval gate and evidence provenance are the core interaction patterns, mapping closely onto Vanta's assessment states and multi-step approval workflows. The framework underneath it, "Trust Is the New Interface," defines the five handoffs that determine whether someone watches, verifies, or delegates to an agent. As Head of Design and Research for North America at Alibaba.com ($50B+ GMV), I redesigned interconnected workflows spanning suppliers, buyers, and compliance layers with different authority levels — the multi-object architecture Vanta's Risk area runs on. As Product Design Director at BCG Digital Ventures, I designed Thermo Fisher's mySupply, a regulated supply chain platform where audit trails and approval workflows were the product.
Most recently, as Head of Product at TinyFish, an enterprise web agent platform, I shipped the agentic platform from 0 to 1 in three months and worked daily with agent traces, auditability, and governance in enterprise deployments. I returned to design to apply that depth to one high-stakes vertical rather than a horizontal platform — and Vanta's builder platform will need trust surfaces designed from scratch as customers gain more agent authority. That's the work I want to do.
I'd welcome 20 minutes to talk about how graduated delegation applies to Risk workflows. My portfolio and the Trust essay are at junochen.com.
Resume emphasis guidance
Scoring first. Craft depth 3 — the posting asks for hands-on design leadership across squads. AI exposure quality 3 — AI-centric workflow builder, agent-powered Risk experiences.
- Lead with Carrier IQ and the Trust essay. The approval gate and evidence provenance map onto Vanta's assessment workflow states. Link both.
- Alibaba second. Head of Design and Research, North America. $50B+ GMV, multi-stakeholder platform redesign. This is the enterprise-complexity proof.
- Thermo Fisher third. Product Design Director at BCG Digital Ventures. Regulated supply chain, approval workflows, audit trails, $20M+ margin recovered annually. Compliance-adjacent credibility.
- TinyFish in the header as bridge. "Most recently, Head of Product at TinyFish (enterprise web agent platform, Series A). Shipped agentic platform 0→1 in three months. Agent traces, auditability, governance in production."
- Move down: Equinox+ and Allē. Neither touches compliance, risk, or agent governance. Keep them on the page; don't feature them.
- Red Cross: visible but not leading. Mission-critical national deployment and six-systems-to-one consolidation are relevant, just third-tier behind Carrier IQ and Thermo Fisher.
Post-outreach signals
Vanta is growth-stage — Series C, $2.45B valuation — so read timing on that clock, not the AI-startup one.
- Reply within 3–5 business days = normal. If Epling engages the trust-surface question specifically rather than routing you to a recruiter, that's the strong version. Respond inside 24 hours and go deeper.
- Recruiter-only reply = the message landed but didn't reach him. Pursue it and get to Epling during the screen.
- Silence past 7 business days = one follow-up on day 8, hooked on something concrete from the September 10 event: a product detail he demoed, a phrase he used. Never "just checking in."
- Head of Design movement — posting language changes, the req disappears, or a hire is announced — changes what the Director role is worth. Check weekly.
- Vanta's authorization platform architecture: Their engineering team published how they built fine-grained access controls as a platform, which reveals how permissions determine what customers see, hide, or disable — useful pre-read if the Director role does own the agent permissions layer.
- Epling's community AMA history: Vanta listed a July 30 Community AMA with Epling covering product direction and leadership philosophy, but no public transcript surfaced — worth checking the community forum for attendee notes before your September 10 message.
- The Staff AI Workflows predecessor: The timeline reconstruction documented a Staff Product Designer–AI Powered Workflows posting whose mandate language resurfaced in the Director role, suggesting the scope expanded after the earlier search.
- Epling's Trustcraft evaluation framework: His Trustcraft engineering series distinguishes production compliance outcomes from impressive demos — language you can mirror when describing Carrier IQ's live approval gates versus conceptual trust models.