Vanta Gets the Application. Gusto and HackerOne Get a Question First.

Vanta is the week. One live posting, a confirmed vacancy, and a departure with a name and a date attached to it. Apply there first and keep everything else on this board off Tuesday morning until you have.

Two problems shape the rest.

The first is arithmetic. Count mandates, not listings. Babylist shows six AI-designer openings sitting on top of two funded problems at most. Gusto hangs a "Head of Design" title on a three-person team, which is a scope disclosure, not a comp footnote. Capital One posted three director roles in a month and all three describe genuinely different territory. Listing volume tells you how a company's recruiting operation runs. Mandate volume tells you what they need a human to actually do.

The second is dating, and it's why the clusters are shaped the way they are. Half this board exposes a defensible original posting date. Half doesn't. Gusto, Capital One, Amplitude, Ramp, and Salesforce are dated. Stripe, Atlassian, Babylist, and HackerOne are not. Ashby and Greenhouse pages render perfectly and emit no origin timestamp, and one Stripe job ID currently resolves to two different roles on two official Stripe routes. A page that loads is not a search that is live. I will not promote anything to Act on the strength of a working URL. So the sort this week runs on which missing fact you can close fastest, and on whether closing it takes a message or an application.

Grouped by move: apply, contact, probe, verify.

Apply this week

One company. The anchoring signal is a named, dated vacancy at the top of a forty-person function, disclosed by the person who vacated it. That outranks every requisition here, and it's the only clock on this board I can actually read. The other three clusters are all waiting on facts I can't close from where I sit. This one needs your application.

1. Vanta. Continuous compliance software. It watches a customer's cloud systems, collects the evidence that security controls are working, and packages that evidence for SOC 2, ISO, and similar audits. Head of Design is live on Ashby.

• Stage / Size / Capital: Late-stage private. The posting describes roughly 40 people spread across governance-and-compliance surfaces, Trust, Platform, self-serve, AI, visual design, design engineering, content, and research. No round or valuation figure verified this pass, and that costs them a point in the rubric below.
• Offices: Unconfirmed this pass. Open the Ashby page and check US eligibility before you spend an hour on the application. If it comes back non-US only, this leaves the board entirely under the geographic gate and Gusto becomes your week. Run that check first, not last.
• Value chain: Midstream. Vanta sits between the customer's infrastructure and the auditor's judgment, converting machine-collected evidence into claims a third party will accept. Value concentrates at the exact point where an automated finding becomes defensible, and that conversion is a design surface.
• Best at: Making continuous monitoring produce audit-ready evidence without forcing the customer to become a compliance expert.
• Signals: Deb Kawamoto took the function from five people to 45. At the end of June she posted publicly that she had left and that Vanta is hiring her backfill. First-person primary source, high confidence, and it closes the ambiguity this section carried in Issue #4 and again on July 24, where public signal couldn't separate a successor search from a parallel-track restructure. It's a backfill. Age: Ashby exposes no original date. The departure anchors the search at roughly 31 days. Kawamoto's profile still surfaces Vanta material in search results; that's indexing lag, not an incumbent.
• The five-person gap. She says 45. The requisition says roughly 40. Either people walked after she did, or somebody shrank the mandate before advertising it. Public sources don't say which. Neither reading kills the role, and both change your first ninety days.
• Tier: Enterprise platform. Tier Playbook: read the Enterprise platform playbook before outreach. One adjustment: expect regulated-domain probing on the compliance surfaces, where the failure mode is a customer signing off on something an auditor later throws out.
• Rubric scores: Company 10/12 — AI centrality 2, Stage/equity 2, Design influence 3, Trajectory 3. Role 14/15 — Total comp 3, Scope 3, Craft depth 2, AI exposure 3, Portfolio value 3. Stage/equity holds at 2 instead of 3 because nothing this pass confirmed a round, a valuation, or a capital figure. Late-stage private is a category, not evidence. Confirm the round, find Series D or later at an accelerating mark, move it to 3, and the company clears 11.
• The craft risk. Craft depth is a 2 and that number understates the problem. Head of Design over roughly 40 people across nine surfaces is a management seat carrying an org-design workload, and you are coming back to design because you miss making things. Be honest with yourself about whether this is the seat where that stops. If the honest answer is uncomfortable, negotiate a named surface you personally own at the craft level, in writing, before you accept. That conversation goes much better at offer stage than at month four.
• Portfolio match: Vanta's hardest surface is the contested finding. The system flags a control as failing. The customer disagrees or defers. Months later an auditor reads that decision cold, with none of the context that produced it. Lead with Thermo Fisher mySupply. Six pharma partners, 100% adoption inside twelve months, a workflow where the audit trail was the product rather than exhaust from the product. The number that lands on this evaluator is adoption, not margin, because 100% adoption in a regulated supply chain means nobody routed around the system to avoid leaving a record. Your edge over a strong AI-design candidate: most of them have designed for the person making the call. You have twice designed for the person who reviews the call afterward, at mySupply and at Carrier IQ. Then add the current-role line, which turns a portfolio claim into a live one. As Head of Product at TinyFish, an enterprise web agent platform, you are working agent traces, attribution, and reversibility in production deployments every week, and that is the same evidentiary problem Vanta's contested-finding surface has to solve for auditors. Bring the Watch → Verify → Delegate ladder from "Trust Is the New Interface" as a framing artifact for the AI surface inside a nine-surface org. Not as the opener.
• Verdict + action: Watch, and the most urgent application on the board. The rubric clears Act on both dimensions. One thing holds it back: the anchoring signal is a design leadership departure at roughly 31 days, which puts it in the 31–60 day band where the advantage is real and already leaking. That's the entire reason; posting date doesn't enter into it. Day 32 is worse than day 31. Apply, then send a short note routed to CPO Jeremy Epling, who framed Vanta at VantaCon UK in May as an operating system for privacy in the AI era. The job page doesn't name him as the report-to. Say so plainly if it comes up, and don't assert a reporting line you can't source. Ask in the first ten minutes: does the backfilled seat carry the same authority and reporting line Kawamoto held, or did the org get rewired after she left? Public sources don't answer it, and the answer separates inheriting a function from inheriting a headcount number.

Contact before you apply

Two roles where one unresolved structural fact is worth more than a submitted application. Two paragraphs of email settle in a day what the posting will never tell you: at Gusto, who this seat reports to, and at HackerOne, whether the search is open at all. Both applications get stronger for having sent the message first. At HackerOne the application may be wasted without it.

2. Gusto. Payroll, benefits, and HR software for small businesses. Head of Design, Unified Service Platform is live on Greenhouse.

• Stage / Size / Capital: Large private company. The posting places the role inside a design organization of 80-plus.
• Offices: US. Confirm site expectations on the posting.
• Value chain: Downstream application, and this seat lives in the service layer underneath the products: self-service, in-product guidance, multichannel support, and the handoff to human experts. Value concentrates where a small-business owner's payroll question either gets answered correctly or turns into a compliance problem.
• Best at: Making payroll and benefits legible to people with no HR function and no time to build one.
• Signals: The requisition describes owning the call on whether an AI output is ready to send, needs human review, or should never go out. CDO Amy Thibodeau published how Gusto builds with AI on June 4, covering intelligent escalation, visible AI behavior, and customer agency. Same problem the posting describes, in her own words. Back in the spring, roughly four months ahead of this cycle, she announced Rebecca Gimenez as Head of Service Design, owning end-to-end journeys and the handoffs between them. Age: 10 days. First published July 22, still live on the direct Greenhouse page August 1, and the only mechanically hot senior design requisition on this board. Contact first anyway. The missing fact here isn't the date, it's the reporting line. Send the note Monday morning and apply the same day, not the following week.
• Tier: Enterprise platform. Tier Playbook: read the Enterprise platform playbook before outreach.
• Rubric scores: Company 9/12 — AI centrality 2, Stage/equity 2, Design influence 3, Trajectory 2. Role 13/15 — Total comp 2, Scope 2, Craft depth 3, AI exposure 3, Portfolio value 3.
• Read the title against the scope. "Head of Design" with three direct reports inside an 80-person org is a strong player-coach seat with a service-layer mandate and peer relationships into product, engineering, and data. Functional head it is not. That's no knock on the job, just the version of it to prepare for. Walk in pitched at the wrong altitude and you'll burn the first conversation arguing for a mandate that was never available.
• Portfolio match: The problem here is the escalation boundary. When does an AI answer reach a business owner unaccompanied, when does a human have to touch it first, and how do you hold that line across channels that don't share state. Lead with American Red Cross. Six systems collapsed into one, $847K disbursed, national deployment across a volunteer network with wildly variable operator skill. Service consolidation where the handoff between self-service, staff, and case worker was the design object, and where money moving made the failure mode concrete. The proof point for this evaluator is six-to-one, not the dollar figure, because Gusto's problem is a fragmented service layer rather than one bad screen. What a consumer-AI candidate can't match: as Head of Product at TinyFish, an enterprise web agent platform, you are shipping agents into production right now and negotiating when an agent's output is safe to release unsupervised. You can discuss escalation policy as an engineering constraint with cost, latency, and failure characteristics attached, rather than as a design value.
• Verdict + action: Watch on company rubric, hot on signal. Move this week. Apply, and write to Thibodeau referencing the June 4 piece and the tension inside it between making AI behavior visible and letting it touch consequential payroll decisions. The fact you need: does this role report into design leadership or into Unified Service Platform product leadership? The posting omits it. Thibodeau is the strongest executive route and Gimenez owns an adjacent mandate, but no public source places this requisition under either of them. Moderate confidence on the route, none on the reporting line. Ask. Don't guess.

3. HackerOne. Vulnerability disclosure and bug-bounty platform connecting organizations to external security researchers. Director, AI Product Design is live on Ashby.

• Stage / Size / Capital: Late-stage private, established platform. No current round or capital figure verified this pass.
• Offices: Unconfirmed this pass. Verify US eligibility before applying. A non-US-only listing removes this from the board under the geographic gate no matter what the 15/15 role score says.
• Value chain: Midstream marketplace and workflow layer. HackerOne owns neither the scanning nor the fixing. It owns the triage in between, which is exactly where the design leverage sits.
• Best at: Structuring adversarial findings from thousands of independent researchers into something an internal security team can act on without drowning.
• Signals: The posting names the CPO as the report-to and the leadership page puts Nidhi Aggarwal in that seat. Cleanest ownership record on the board, high confidence. Her byline on the discovery-remediation gap lays out the validation and prioritization problem this role exists to close. Age: unresolved, and probably old. Issue #5 reported this role pulled from HackerOne's active feed at 49 days per a job mirror. The direct page loads today. High confidence the page is reachable, low confidence the search is open, zero confidence in a reset clock. That's a factual update on availability and I'm not dressing it up as more than that.
• Tier: Enterprise platform. Tier Playbook: read the Enterprise platform playbook before outreach.
• Rubric scores: Company 9/12 — AI centrality 2, Stage/equity 2, Design influence 3, Trajectory 2. Stage/equity is a 2 by default rather than by evidence. No capital or valuation figure supports a 3 and I'm not inventing one. Role 15/15 — Total comp 3, Scope 3, Craft depth 3, AI exposure 3, Portfolio value 3.
• Portfolio match: Aggarwal has already stated the problem in public: machine-generated findings arrive faster than humans can validate or rank them. The design object is a triage surface where being wrong in either direction costs money, and where the operator decides at volume under time pressure. Lead with Retail Velocity from Agentic Labs, live at junochen.com. CPG field intelligence, where the work was ranking machine-generated signals so a rep acts on the right one inside a narrow window. The proof point is that it's a published, inspectable alerting-and-ranking case instead of a chat interface, which separates it from roughly every AI portfolio this committee will see this quarter. Anchor it in present tense with TinyFish: validating agent output before a human commits to it is your daily production problem, in enterprise deployments, and that is the exact shape of the discovery-to-remediation chain Aggarwal describes. The non-obvious edge is the five-handoffs framework in your Trust essay, which hands you working vocabulary for that chain and lets the first conversation be about her problem rather than your résumé.
• Verdict + action: Watch. Don't apply cold into a requisition that may be closed. Write to Aggarwal first, reference the remediation-gap piece, ask whether the AI Product Design search is still open. Yes, and you apply the same day. No, and you've opened a line to a CPO who owns design and has just told the market what her hardest problem is.

Probe the listing, not the role

Send a probe when the listing itself is the thing you don't trust. You're asking a structural question whose answer decides which application you submit, and the question doubles as proof that you read the board more carefully than the rest of the pipeline did. Babylist is the only entry that earned this move this cycle, because it's the only one where the postings contradict each other in a way a single question can settle.

4. Babylist. Baby registry and commerce platform. Parents build a registry spanning retailers, gift-givers buy from it. The board currently shows AI Builder design roles at Director, Staff, and Senior level across the US and Canada.

• Stage / Size / Capital: Private, consumer commerce.
• Offices: US and Canada listings, both open.
• Value chain: Downstream and two-sided. Babylist monetizes gift-giver conversion against registrant intent.
• Best at: Being the registry that works across every retailer instead of locking parents into one.
• Signals: Six listings, fewer mandates. The US and Canadian Director postings run identical mandate language: own Registry, report to an unnamed VP/Head of Product Design and Research, sit on the Consumer Tech leadership team, lead three to four designers. What differs is geography and a US pay disclosure. Not scope. The Staff role is genuinely distinct: durable domain ownership, a 12-to-18-month vision requirement, production-quality front-end code. The Senior role reuses the same template one level down. Best-supported reading, moderate confidence: one Director mandate advertised twice, plus one IC demand pattern advertised at two levels with unknown funded headcount. Both IC descriptions use plural language. Neither names a team, a reporting line, or a seat count. Age: unresolved on all four.
• Why unresolved age doesn't sink it here. I killed Rubrik and froze HackerOne's clock on exactly this basis, so the exception needs a reason. The reason is the ladder. Running the same mandate at Director, Staff, and Senior simultaneously across two countries is what calibration looks like when a search hasn't resolved yet. Stale reqs nobody took down don't fan out across three levels. Moderate confidence, and it's inference from posting structure rather than a date, which is precisely why the move here is a question and not an application.
• Tier: Growth-stage platform. Tier Playbook: read the Growth-stage platform playbook before outreach.
• Rubric scores: Company 8/12 — AI centrality 2, Stage/equity 2, Design influence 2, Trajectory 2. Role (Director) 10/15 — Total comp 2, Scope 2, Craft depth 2, AI exposure 2, Portfolio value 2.
• Portfolio match: Registry is a two-sided surface where one audience's behavior creates the other's revenue event, and the AI layer is recommending purchases to a first-time parent with no domain expertise and a high anxiety baseline. Lead with Allē. Thirty million members, a dual-surface redesign spanning consumer and provider, 3.2× redemption lift at $42 CAC. The redemption multiple is the number that matters, because it shows you moved the conversion side of a two-audience economy instead of polishing the browsing side and hoping. Your edge: everyone in this pipeline will pitch recommendation UX. You shipped a two-sided consumer program where the second audience's action was the business model.
• Verdict + action: Watch, ranked fourth. It clears the threshold on company score, not on enthusiasm. Don't apply to a listing yet. Message the VP/Head of Product Design and Research, unnamed on the postings, identifiable through the Babylist design org before you write, and ask one clean question: is the Registry Director seat funded and distinct from the Staff AI Builder search, or is one leadership requisition being calibrated across levels? The answer tells you which application to submit, and asking it demonstrates the exact mandate literacy the Director role claims to want.

Verify before anything else

Four entries where the next action is confirming a fact, not writing a pitch. Full field sets are wasted until each resolves, so these run compressed: the fact in question, the trigger that would move them. Three are here because a page loads and nothing else about them can be established. Capital One is here for a reason that has nothing to do with its own postings.

5. Stripe — Staff Product Designer, Link. The posting loads with Apply Now available and emits a July 27 date. Don't trust it. Don't dismiss it either. Job ID 7202630 currently maps to Link on one official Stripe route and to Senior Staff Product Designer, Payments on another. When an identifier mutates across a company's own pages, neither date establishes when the search opened. Age unresolved. Now run the other branch. If July 27 is the real opening date, this role is five days old, sitting squarely in the hot window, and it is the freshest thing on the entire board. Confirm two facts in the same call: which role the ID actually belongs to, and the office list. The Link posting carries a U.S. base range of $210,400–$315,600, so US eligibility looks intact, though with the identifier moving around Stripe's own routes you should confirm the location on the role you'd actually be applying to rather than the one the URL happens to render. Verdict: Ignore-until-trigger. Trigger: a recruiter confirms role identity and US eligibility. Confirmed with a July 27 origin, this goes straight to Act.

6. Atlassian — Principal Product Designer, AI (Mobile). The official listing is still indexed with a full description, job ID 21602, Pacific time zone eligibility, and a stated report-to of Senior Design Manager, AI. Direct retrieval returned a 403 this pass and no original date is exposed. Age unresolved. Open status not certified. Load it manually, and register the report-to before you get attached: a Principal IC reporting into a Senior Design Manager is a craft seat, not an org seat. Verdict: Ignore-until-trigger. Trigger: the page opens directly and a recruiter confirms the role is open with a date.

7. Rubrik — Director, Product Design. The current page renders the title as Director, which settles a question earlier cycles left open. It settles nothing about age. That same job ID traces back to a February 5 origin, and a July 31 platform refresh is not a repost. Verdict: Ignore-until-trigger. Trigger: a new requisition ID, or a recruiter confirming an active slate.

8. Capital One. Three director-level design mandates posted in July, describing three real problems rather than one search dressed three ways.

Accelerator crosses the freshness threshold August 4. Card Servicing is the freshest of the three. All three sit under Experience Design, several hundred designers, led by CDO Daniela Jorge. Company 6/12 — AI centrality 1, Stage/equity 1, Design influence 2, Trajectory 2. Role approximately 9/15. Verdict: Ignore-until-trigger on all three. Trigger: an AI-central design mandate with equity structure that clears the board. A public bank with no pre-IPO equity and no AI-central mandate doesn't earn a slot on title density.

Why the entry exists anyway: Brex is on your target list and Brex is now Capital One. The acquisition closed April 7, Pedro Franceschi remains Brex CEO, and Brex results now report inside Capital One's Credit Card segment. Brex's post-close design reporting line is not publicly resolved, and any read on it is speculative. This is the thinnest inference in the issue and I'm labeling it as such. Before the deal, CDO Matt Bango stated publicly that design reported directly to Franceschi. His profile still lists Brex with no current title exposed. Treat Brex as an unresolved account rather than a dead one, and don't enter a Capital One or Brex conversation without asking where design landed. Then notice what's absent. Accelerator is the only one of the three postings that mentions new acquisitions in its mandate, and none of the three mentions Brex by name. The silence is the finding.

Off the board

Named plainly, because prior issues told you otherwise.

Amplitude — downgraded to Watch. Issue #4 told you to move by Wednesday on the strength of CPO Gab Menachem's April 14 appointment. He's 109 days in seat. The executive-access advantage is spent. What remains is the posting: Head of Product Design, published July 7, still live August 1 at 25 days, mechanically Watch and not hot. Fifteen-person team across Core, Statsig, and Wave. SF target cash $317K–$476K plus equity. Nothing about the mandate deteriorated; the queue ahead of it matured. Apply only after Vanta and Gusto are out the door, and hook the note to his "intelligence layer" framing.

Ramp — Ignore-until-trigger. Director, Product Design remains reachable at 54 days from a June 8 origin. Trigger: new role ID or recruiter confirmation of an open slate.

Salesforce — Ignore-until-trigger. VP, Product Design, Informatica is live and dated May 15. Seventy-eight days. VP searches at this scale do run long, but 78 days without a repost means the slate assembled two months ago and you'd walk in as the comparison candidate.

Scanned and cleared. Anthropic, OpenAI, Adobe, and Zoox produced no rubric-qualifying signal this cycle. No new design leadership requisition, no dated executive move, no funding trigger inside its window. Two exceptions I'm holding rather than clearing: Abridge (Staff Product Designer, clinical AI notes with linked evidence and auditable outputs, $216,750–$255,000) and Headway (Staff Product Designer, Group Practices, $212K–$265K). Both live, both age-unresolved, both carded next cycle once a date or a recruiter confirms the window. Anthropic stays a high company score with nothing actionable attached, which is its standing condition rather than news.

Three messages this week, in this order: Epling at Vanta, Thibodeau at Gusto, Aggarwal at HackerOne. Vanta and Gusto each get an application attached. Vanta because the departure clock is running, Gusto because the requisition is ten days old and you will not get a cleaner entry point than that. HackerOne gets the question alone, because there the question is worth more than the application and costs less. Before any of it, run two checks: Vanta's Ashby location field, and Stripe's recruiter on the phone by Monday. Five minutes each, and between them they decide where a full week of effort belongs.