JOHN TROTTA

I design and build technology, security, and AI programs for regulated industries.

I've spent 17 years in regulated financial services across technology, security, and operations. I design and review security controls, assess cyber and third-party risk, and partner with engineers to architect systems that pass audits without slowing the business: SOC 2 Type II, PCI-DSS, and HIPAA stood up from nothing and mapped to NIST CSF, 10+ audits passed with zero material findings, zero major incidents over eight years. And I still build: AI products that carry real revenue, compliance monitoring that replaced manual spot-checks with full coverage, and the secure data flows a 300-person firm runs on. I'm the technical voice to ownership, clients, legal, and regulators on risk acceptance, control strategy, and emerging technology. Operations background, CISSP, daily user of agentic AI, and I still write code when it's the fastest path to the answer.

Experience

Chief Technology & Security Officer

RTR Financial Services, Inc.

August 2019 - Present

Staten Island, NY

Own technology, product, and operational systems for a regulated mid-size financial services firm running across hybrid on-prem and cloud. Full accountability for what gets built, how it runs, and the security and compliance behind it.

  • Conceived and built an AI phone system that turned a manual call workflow into a self-service revenue channel now worth an estimated 10% of company revenue. Thousands of calls a day, routed and handled automatically.
  • Built and own an AI call-monitoring platform across 65+ agents and thousands of daily calls: logging, sentiment, and automatic verification of required legal disclosures and consent, replacing manual spot-checks with full coverage and giving managers a real-time view they never had.
  • Build AI ops tooling: agentic workflows that monitor, remediate, and report on their own, with anything risky routed back for approval.
  • Built the secure data flows the business runs on: site-to-site VPNs across data centers, API connections from internet-facing systems into isolated back ends, API and FTP transfers, and BI wired straight to production databases, all change-managed and auditable.
  • The technical voice to ownership, clients, legal, and regulators: turn vague business problems into things that ship, and carry the proposals, RFPs, and security reviews that underpinned more than $10M in regulated-client revenue.
  • Automated 80 to 100 hours of manual work a month across clerical, operations, and compliance, and cut technology spend roughly 30% through architecture rationalization and vendor consolidation while the business grew fourfold.
  • Built the company's first real disaster recovery and continuity and drove uptime to 99.99%, scaled the environment from 75 to 300 employees, and moved to multi-state remote operations in a week when COVID hit, opening up 8+ states.
  • Stood up the company's security and compliance from nothing: SOC 2 Type II, PCI-DSS, and HIPAA, first-time certification on each, zero major incidents in eight years.

IT Manager

RTR Financial Services, Inc.

2016 - August 2019

Staten Island, NY

  • Ran the WannaCry ransomware recovery with no DR plan in place, pulling together internal staff and vendors to restore full operations in 48 hours.
  • Owned availability, security, patching, and compliance across every enterprise system.

Infrastructure & Security Lead

RTR Financial Services, Inc.

2014 - 2016

Staten Island, NY

  • Transformed how the existing environment was used: reworked current tools, standardized automation with PowerShell and Python, added new systems as extensions to what was already in place, and built the procedures to meet new client requirements.

Systems Administrator

RTR Financial Services, Inc.

2012 - 2014

Staten Island, NY

  • Administered the company's core systems day to day, keeping a lean environment running under the IT manager who owned the network.

Business Analyst

RTR Financial Services, Inc.

August 2008 - 2012

Staten Island, NY

  • Worked across reporting systems, analytics, and business processes to measure and improve operations.

Skills

Product & Systems

Systems ThinkingAPIs & IntegrationsData Flows & PipelinesWorkflow AutomationRequirements & SpecsInstrumentation & MetricsTelephony & Comms SystemsBuild vs. Buy

Security and Compliance

SOC 2 Type IIPCI-DSSHIPAANIST CSFSecurity Program LeadershipPolicy AuthoringAudit ManagementThird-Party Risk ManagementIncident Response

Infrastructure and Cloud

Hybrid Cloud StrategyCloud MigrationVDI & Remote WorkforceDisaster RecoveryBusiness ContinuityEnterprise ArchitectureTechnology ModernizationIT Service Management

Engineering and Automation

AI StrategyAI-Driven OperationsAgentic WorkflowsProcess AutomationInfrastructure as CodeCI/CDEngineering Velocity

Executive Leadership

Strategic Advisory to OwnershipTechnology Budget ManagementVendor NegotiationOrganizational ScalingRevenue EnablementTeam LeadershipRegulator LiaisonLean Operations Management

Certifications

CISSP

Certified Information Systems Security Professional

ISC2

PMP

Project Management Professional

PMI, in progress (2026)

VCP

VMware Certified Professional

Data Center Virtualization 6.7

MCSE

Microsoft Certified Solutions Expert

Windows Server Security and Core Infrastructure

CCNA

Cisco Certified Network Associate

Implementing and Administering Cisco Solutions

Education

CUNY Baruch College

Zicklin School of Business

Bachelor of Business Administration, Operations Management

New York, NY

Projects

AI Phone System (IVR)

An AI-driven phone system that turned a manual, rules-based call workflow into a self-service revenue channel. Handles thousands of calls a day with routing, self-service, and follow-up. Contributes an estimated 10%+ of company revenue.

Tech: Cloud Telephony, SIP, Python, LLM APIs, Speech-to-Text

Compliance Monitoring Platform

AI platform that replaced manual spot-checking with full-coverage legal disclosure verification and sentiment analysis on customer calls. Closed the compliance blind spots that sampling could never catch.

Tech: Python, Speech-to-Text, LLM APIs, Sentiment Analysis

Homelab

Production-grade k3s cluster on ProxMox, GitOps-managed with Flux. Runs 25+ services across monitoring, automation, media, document management, and AI workloads. Bare metal.

Tech: ProxMox, k3s, Flux, Kube-Prometheus, Velero, Loki

OpsMan

Semi-autonomous AI ops manager for the homelab. Watches ProxMox and Kubernetes, runs approved Day-2 operations, logs everything. Anything risky comes back for approval.

Tech: Python, ProxMox API, Kubernetes API, Pushover

What I Build With

The core of what makes me productive. The rest of my stack lives in GitHub.