RBC Security Team

Security at RBC

Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.

3 Intel Signals

How they approach application security

RBC's AppSec philosophy emphasizes safeguarding hybrid-cloud environments and views cybersecurity as more than just an IT concern.
They aim to support secure agile application development and bring new security tools to developers.
Their risk philosophy includes rapid risk assessments, third-party assurance, adversary emulation, threat hunting, and threat modeling.
Stated goals include improving the security and quality of RBC applications and prioritizing and triaging SAST security scan results.
However, no explicit public verbatim statements were found regarding a "security champions"program, specific SLAs/MTTR for remediation, or exact SAST/SCA/DAST vendor names.

The team

The RBC AppSec team appears to be part of a centralized global security function, with "Global Security Operations"and "Application security and cloud"listed under RBC cybersecurity technology.
Key public-facing leaders include Milos Stojadinovic, RBC Distinguished Engineer, who "leads a global team of 35 experts", and David Sfiligoi, Director, Application Security.
As of May 14, 2025, the team size estimate is around 35 experts.
A LinkedIn search query used was "site:linkedin.com RBC "application security" OR "Application Security"".
As of November 14, 2025, at least one direct Application Security Consultant job posting was active, with additional related roles found.
Common skill and tool patterns in job postings include "SAST, SCA and DAST", "triaging findings and refining scanning rules", and "Understanding of CI/CD, DevOps and DevSecOps approaches".
No public organizational chart or explicit reporting chain (e.g., to CISO) was found.

What they're working on

No public evidence was found for a Security Champions Program. RBC practices "shift left"by aiming to "assist in the integration of application security processes and tools into existing enterprise development processes and pipelines"and to "bring new security tools for developers". Their vulnerability management process involves intake from SAST, SCA, and DAST testing techniques, with a focus on "support end users of application security testing tools, managing tickets through a ticketing platform"and "prioritizing and triaging SAST Security scan results". However, no public verbatim statements were found regarding remediation SLAs, MTTR, or ticket ownership beyond general ticket management. Secure SDLC artifacts are mentioned through required "Exposure to application security best practices such as secure coding, security testing techniques and Secure Software Development Lifecycle". Recent initiatives include a job posting for an Application Security Consultant and a newsroom article on advanced threat detection , but no specific AppSec-only program rollouts within the last six months were publicly identified. No public detailed process documents on triage SLAs, remediation workflows, or a formal Security Champions program were found.