With the advent of the smart grid, demand response (DR) has been implemented in many electric utility control areas to reduce peak demand in buildings during grid stress conditions. However, small- and medium-sized commercial buildings typically do not deploy a building energy management (BEM) system due to high costs of commercially available solutions. Thus, their participation in DR events implies manual control and shutting down major building loads (e.g., air conditioning systems) without considering occupant comfort. With rapid development of Internet of Things (IoT) technologies, some cost-effective IoT-based BEM systems have become available. Based on such systems, this paper presents an algorithm to automatically coordinate the operation of rooftop units (RTUs) in small- and medium-sized commercial buildings, thereby meeting the specified power limit (kW) during a DR event while taking into account occupant comfort. The proposed algorithm has been designed to intelligently learn building thermal properties using coarse-grained indoor temperature data from thermostats, thus avoiding the deployment of sophisticated sensors network. A mixed-integer linear programming model has been utilized to determine an optimal RTU control strategy during a DR event. The peak load shedding performance of the proposed strategy has been tested in an office building in Blacksburg, VA, USA. The experimental result demonstrates that the building could achieve the required peak load reduction and the computation time required by the proposed algorithm is less than 5 min. This implies that with the proposed algorithm a building is capable of responding to a DR signal with a short notice, providing valuable demand-side resources for electricity capacity and ancillary markets.