Vanta posted a Head of Design role on July 6. Fifty-four days later — no public hire, no posting-language revision, no design leadership announcement — a Director of Product Design appeared on August 25, scoped to Vanta's Third-Party Risk Management product area.
Two design leadership postings, open simultaneously, with no stated relationship between them. Neither references the other. Neither names a reporting line that connects them. That gap is worth pulling apart.
I covered the Head posting in Issue #6 as a quality-system search disguised as a succession hire, and in Issue #7 urged you to move that week while the director bench appeared intact. Two things have changed since then, and a third confirms the direction.
The events that matter
Jenny Chang left. Chang, whose remit covered Self Serve and AI strategy, departed Vanta in July and is now Head of Design at Roadrunner. The director bench dropped from four to three: Braden Kowitz (GRC), Jerrod Larson (Automation and Design Systems), and Conor Sheehan (whose pillar isn't publicly stated but whose activity connects to Vanta Agent and Customer Commitments work).
Chang's departure did two things. It thinned the internal-candidate pool for the Head role. And it left a coverage gap — someone had been responsible for Self Serve and AI, and now nobody visibly is.
An IC mandate got promoted to Director level. Before either leadership posting existed, Vanta had a Staff Product Designer, AI Powered Workflows role, traceable to February. That role is no longer in Vanta's active feed. The August Director posting repeats its three-sentence paragraph about defining a net-new, AI-centric workflow builder verbatim, then wraps it inside a broader TPRM mandate with people management, risk-domain strategy, customer discovery, and product-area leadership.
Whether the Staff search was filled, cancelled, or formally converted into the Director requisition isn't publicly documented. The language inheritance is clear: the AI workflow mandate has been looking for a home since winter. It started as an IC seat. Six months later, it resurfaced inside a Director-level role with substantially more scope.
TPRM's strategic visibility confirmed the elevation. Vanta shipped a TPRM Agent in June, Epling framed AI vendor risk as a category-defining problem in press, and the company published content arguing AI adoption creates oversight gaps outside traditional procurement. This explains the Director posting's seniority level, but the product-area investment was already underway before the posting appeared. Confirmatory, not causal.
The Head posting held steady. The Head posting text shows no detectable change since July 9. Same language, same requisition identifier. A Head of Design search running 54 days without a language revision is consistent with normal senior-leadership timelines — three to six months is standard at this level. It also means the committee hasn't been forced to recalibrate through a failed first slate. Or at least hasn't signaled that recalibration publicly.
What the Director role covers and what it doesn't
The Director owns TPRM product-area design: risk registers, dashboards, assessment workflows, vendor monitoring, and the AI-centric workflow builder inherited from the Staff posting. They lead a team of product designers, set area-level strategy, run customer discovery, and represent Design in leadership and product-review forums.
What the Director does not own: Vanta-wide design standards, the design system, organization-wide AI practice, definitions of done, launch-review frameworks, design-org structure, or hiring standards across Design. Those responsibilities sit in the Head posting, which covers approximately 40 people across GRC, Trust, Platform, Self-serve, and AI.
The authority boundary between the two roles is clean on paper.
The Director posting names no reporting relationship — not to the future Head of Design, not to Epling, not to a current director, not to Product. The posting describes partnerships with Product, Engineering, Research, Content Design, Design Systems, and Go-to-Market, but never says who this person reports to.
Companies typically name the reporting relationship at Director level because candidates evaluate the role partly based on who they'd work for. When a posting omits it, one of three things is usually true: the reporting line hasn't been decided, the reporting line depends on a hire that hasn't closed, or the company is deliberately keeping options open because they aren't sure which structure they'll land on.
The pattern
Vanta opened the Head of Design search to replace Deb Kawamoto and reclaim design authority over quality systems. That search is proceeding on its own timeline. While it ran, the bench shrank (Chang left), a strategically important product area gained executive visibility (TPRM Agent launch, Epling press), and an AI workflow mandate that had been floating since February as an IC role still hadn't found a home.
The Director posting is Vanta addressing the operational gap it can close now — staffing a product area at the right seniority level — while the org-wide leadership search continues separately. The up-leveling from Staff to Director, the timing after Chang's departure, and the TPRM investment signals all point to a reactive decision made during the Head search. If this had been planned before the Head search opened, the two postings would likely have appeared closer together, and the Director posting would name a reporting line to the Head role.
The reporting-line omission confirms the reactive read. Vanta can't commit the Director to reporting to a Head of Design who doesn't exist yet, and committing to a different reporting line — Epling, or a current director — would constrain the incoming Head's ability to structure the org. So they left it blank.
Vanta is filling the seat it can close while the org-wide seat stays open.
Prediction
The Director role closes first, likely within six to eight weeks. The Head search continues on its own timeline. From the July 6 posting date, a standard three-to-six-month senior leadership search puts the close between October and January. The absence of a language revision suggests the committee hasn't hit a wall that forced a reset, which is consistent with the later half of that range. The Director hire will report to whoever fills the Head seat.
If an internal candidate gets the Head role, Kowitz is the most plausible. He holds the broadest title on the bench (Director of Design, while the others carry Director of Product Design or Design Director titles), and his GRC scope covers the largest product area — the closest current analog to the Head role's org-wide quality mandate. An internal promotion would clarify the Director hire's authority ceiling faster. If the Head search extends or resets, the Director operates in a period where their actual authority depends on Epling's interim management of the design org.
The Head search has been quietly paused or cancelled, and the Director posting represents the new ceiling for external design leadership at Vanta. The Head posting is still live with its original identifier and original language — but the public record can't confirm active candidate advancement for either role.
What this means for you
You have two viable paths at Vanta right now. The authority-boundary analysis above is why they require different proof: the Director is a product-area craft-and-strategy role, the Head is an org-wide methodology role, and the same background leads with different work for each.
Put your energy on the Director this week. It's four days old. The product area has clear momentum. The role carries real authority within its domain, including the AI workflow builder mandate that Vanta has been trying to staff since February. Your fit is strong: enterprise trust design at Alibaba, regulated-domain proof at Thermo Fisher and Red Cross, AI-native production experience at TinyFish, and the Trust essay's framework for human oversight of agent decisions maps directly onto a product where the agent "leaves the final call with the customer's TPRM team."
The Vanta Inflection Point piece covers the specific outreach angle and diagnostic question for the Director role. This reconstruction gives you the structural context underneath: the reporting line is unresolved, the role absorbed a mandate that's been floating since February, and the authority ceiling depends on a Head hire that hasn't happened yet.
Ask about the reporting line early. The answer tells you whether you're joining a team with a leader or joining a team that's waiting for one.
- Epling's own evaluation criteria: In his First Round interview, Epling said he responds to specific details, underlying assumptions, and evidence over generic statements — useful calibration before any message reaches him.
- The AI Foundations PM role: Vanta's August 12 Staff Product Manager, AI Foundations posting claims ownership of the shared AI evaluation stack and launch-readiness quality bar, which means the Director's AI-workflow authority may share a boundary with a PM peer who controls quality tooling.
- Chang's actual departure timing: Her LinkedIn activity places the exit in July but doesn't specify the date, so whether she left before or after the Head posting went live on July 6 remains a gap worth closing if you get into process.
- Vanta's TPRM product momentum: The June TPRM Agent launch made concurrent assessment workflows generally available and placed continuous vendor monitoring in preview — the Director inherits a product area that's shipping, not waiting for direction.