JutsuAI Security Operations Platform
An AI-native SOC platform that replaces SIEM, SOAR, threat intel, compliance and reporting tools with one console.
- Role
- Lead Full Stack Engineer
- Timeline
- Jun 2026 - Present
- Type
- Project I worked on
- Stack
- TypeScript, Bun +13
Overview
Jutsu (jutsu.ai) is an all-in-one security operations platform for teams that can't staff a 24/7 SOC. The console at app.jutsu.ai connects to a company's cloud accounts, identity providers, SaaS apps, code hosts and servers, normalizes everything into OCSF events in ClickHouse, and runs Sigma detections over it. AI agents then do the work of a tier-1 analyst: they enrich and score every alert with a verdict and the reasoning behind it, correlate related alerts into incidents, write the investigation, and recommend or run policy-approved response actions such as deactivating a leaked key or blocking an IP at the edge. The same data drives continuous SOC 2 and ISO 27001 readiness, scheduled SOC reports, and Jutsu AI, a copilot that answers questions about the whole workspace. I'm the lead engineer on the platform and work across the ingest pipeline, the multi-tenant API, the detection and AI triage services, and the React console. The console screenshots show a demo organization with made-up data.
Highlights
- 01Pull connectors for AWS, GCP, Google Workspace, Microsoft 365, Okta, GitHub, Cloudflare, Vercel and password managers, plus host collectors for Linux, Windows and macOS
- 02Vector ingest pipeline that normalizes every source to OCSF and stores it per tenant in ClickHouse
- 03Event search with a query language, facets, a volume histogram and a field-level event inspector
- 04Sigma rule engine with an in-browser YAML editor, rule testing, a community rule marketplace and MITRE ATT&CK coverage mapping
- 05AI alert triage with risk and confidence scores, a verdict with its reasoning, threat-intel enrichment and an attack timeline
- 06Incidents built from correlated alerts, with AI-written investigations, SLA tracking and a full audit trail
- 07Response actions such as key deactivation, edge IP blocks and session revocation, auto-approved by policy or held for a second approver, with one-click revert
- 08Continuous compliance readiness for SOC 2, ISO 27001, CIS Controls and PCI DSS from one shared control catalog
- 09Scheduled and on-demand SOC, executive and compliance reports with AI-drafted summaries
- 10Jutsu AI, a copilot that searches alerts, events, incidents and assets and cites its sources
- 11Multi-tenant RBAC, Google sign-in, MFA with passkeys, audit logging and Stripe billing
Gallery
Inside the product
14 screens · click any to enlarge
