Holacracy, Circles, and Real Ownership: Inside Bacher Systems’ Cybersecurity with Christian Üblbacher

Context and core message of the session

In the session “Christian Üblbacher, Business Owner Cybersecurity bei Bacher Systems,” we at DevJobs.at got a clear, practice-oriented look at a company that treats cybersecurity as the intersection of purpose, structure, and collaboration. Speaker: Christian Üblbacher. Company: Bacher Systems. Story Category: techleadstory.

Bacher Systems has about 120 employees and organizes the work across three business areas: Cybersecurity, Hybrid Infrastructure/Platforms, and Data Analytics. What stood out in Üblbacher’s remarks is how structure—specifically a holocratic organization with circles and roles—shapes day-to-day work; how recruiting and onboarding are run; and why services point the way forward. The overarching organizational purpose is succinct and memorable:

This intent threads through everything—from team organization and partner selection to how services are designed and how the company finds, grows, and enables talent.

Three business areas, one shared purpose

Bacher Systems structures its work into three focused business areas:

• Cybersecurity
• Hybrid Infrastructure and Platforms
• Data Analytics

All business areas are integrated into a customer-centric circle and operate against the same purpose: to make security and reliability tangible so customers can sleep calmly at night. For engineering teams, that means technology choices are anchored in customer value rather than being purely technology-driven.

Holacratic organization: circles instead of hierarchy

Üblbacher explains that Bacher Systems has implemented a holacratic organizational form over the past two years—not as a rigid template, but adapted to the company’s values and strengths built over decades:

• There is no classic line hierarchy with a single manager consolidating strategy, numbers, budget, and personnel topics.
• Instead, the company is structured into circles. People work in clearly defined roles within each circle, and those roles have a purpose.
• Decisions are distributed “across many shoulders.” Technical and personnel responsibilities are explicitly separated.

On the technical side, there are roles like Business Owner—for Üblbacher in Cybersecurity—covering strategy, portfolio, and marketing. On the people side, there are People Partners who support employees individually.

The Security business area forms its own circle with a circle lead who ensures that “the whole system works” inside the circle—skills, training, processes, and role clarity. A key principle: the circle organizes itself.

That includes creating new roles, changing processes, and setting its own priorities. Üblbacher puts it succinctly:

For tech talent, this means ownership is not an abstract idea—it is structurally embedded. If you like working in clear roles with real levers to shape outcomes, you’ll find a setup designed to enable exactly that.

Collaboration within and across circles

Circles are built to fulfill their purpose independently. External parties do not impose directives on a circle. This creates focus and speed—and it requires mature, transparent collaboration within the circle:

• Roles clarify purpose and responsibilities.
• Process and responsibility changes can be decided inside the circle.
• The circle lead keeps the system coherent—focusing on skills, training, processes, and roles.

The result is a mode of working where teams truly own their outcomes—not just formally, but structurally. In cybersecurity, where assessments and decisions are often time-sensitive, that autonomy is a competitive advantage.

Recruiting in security: beyond job postings

Üblbacher is frank about what the market feels: security talent is in high demand, and typical job ads won’t cut it. Bacher Systems responds with structure, networks, and a clear stance:

• People & Culture Management and a Recruiting Team support the business areas.
• The first step is to define the role profile together and decide which platforms and channels best reach the target group.
• The company is present in networks that surface talent. Üblbacher highlights the Cyber Security Challenge—an initiative that engages schools, runs a qualification path, and hosts its finals at the IKT-Sicherheitskonferenz.

Üblbacher refers to the IKT-Sicherheitskonferenz as a major security conference in Austria. Talents from the challenge go on to compete across Europe and are connected over the years inside a “Center of Excellence,” forming a pool worth staying close to.

In addition to networks, Bacher Systems pays attention to the tone of job ads—creating postings “that stand out a little” to attract the right profiles.

Selection: social skills, team fit, and a two-way experience

During selection, business areas and People & Culture interview candidates together. The focus is clear:

• Many technical topics can be learned.
• Social skills and team integration must fit first.

The process is intentionally two-sided: candidates meet their potential teammates early. According to Üblbacher, that is a “huge added value,” because both sides learn whether the day-to-day environment feels right.

Onboarding: People Partner, buddy program, and learning over time

Once the match is made, onboarding begins—and Üblbacher contrasts it with many large-company approaches. A People Partner “takes care of you,” and there is a buddy program:

• The buddy holds the same role as the new joiner and supports them right at the point of practice.
• General training introduces the organization, goals, culture, and systems.
• Then role-specific training follows—tailored to what is needed to fulfill the role.
• Learning is spread over a longer period, allowing new hires to “grow in gradually.”

This fits the culture Üblbacher describes: people come first. Onboarding isn’t a one-off bootcamp but a development path with guidance and space to build lasting knowledge.

Compliance, critical infrastructure, and why services matter

Üblbacher frames today’s security landscape as broad and dynamic: it’s far beyond “antivirus and firewalls.” Compliance requirements are on the rise, especially for critical infrastructure. In many cases, concrete mandates and consequences are needed for progress to happen.

From Bacher Systems’ perspective, this leads to a clear trajectory: services are becoming more important. Companies focus on their core business, and security competence is often not it. At the same time, the talent market is tight. That’s where Bacher Systems steps in:

• Services take on tasks that are not part of the customer’s core business.
• The Security circle’s know-how becomes a value-add for customers.
• Customers are supported to become “a bit more secure” over time—without having to do everything themselves.

This includes proactive advisory and responses “around the clock.” Customers are notified when something emerges; then follows a joint discussion of next steps—with technical perspective and respect for the customer’s business processes.

Technical security in the context of business processes

A concrete illustration from Üblbacher makes the point: not every system can be isolated easily. If a company’s business hinges on a webshop, taking it offline comes with non-trivial consequences. In large organizations, dependencies can be intricate.

Bacher Systems therefore engages customers in a dialogue that reconciles technology and process. What is possible? What is responsible? Which steps are feasible—technically and in terms of the customer’s value creation?

The partnership approach is central: security is not an end in itself; it supports business outcomes and requires balanced decision-making.

Portfolio and partners: clarity about your place

Üblbacher underscores the need for Bacher Systems to know its place in the ecosystem: which partners to include in the portfolio, and where the company can offer mutual value. The goal is to bring customers an offering that truly helps, not a random list of features.

For teams, this means technology is selected for impact, not trendiness. The portfolio is curated around customer value and the company’s strengths.

Why Bacher Systems is attractive for tech talent

From the DevJobs.at editorial vantage point, Üblbacher’s insights translate into compelling reasons for talent:

• Real ownership: Decisions are “distributed across many shoulders.” Roles have a purpose, and the circle self-organizes.
• Clear purpose: “So that our customers can sleep well” is more than a phrase—it shapes priorities and choices.
• Enabling structure: The split between technical and personnel responsibility (Business Owner and People Partner) creates both focus and support.
• Learning by design: Buddy program, general and role-specific training, and a long onboarding arc—with people at the center.
• Work in the network: Proximity to initiatives like the Cyber Security Challenge, presence at the IKT-Sicherheitskonferenz, and links to the “Center of Excellence.”
• Services that matter: Proactive guidance and “around-the-clock” response—tackling real customer scenarios where technical skill and process understanding both count.
• Circle autonomy: “We practically operate like our own company.” If you want to shape, this structure lets you.
• Team fit first: Social skills and integration into the team take deliberate priority.

The result is an environment where technology, organization, and people reinforce each other. For security professionals—and those who aspire to become one—that’s a compelling mix.

Working with People & Culture: a joint selection process

It’s noteworthy how tightly People & Culture and the business areas collaborate. Together they shape the role profile, align on platforms and channels, and co-lead the selection. The two-way experience—with early exposure to potential teammates—is an intentional part of the process.

For candidates, that means you can see how the circle works early on—and decide if this setup fits the way you like to work.

How leadership works in holacracy

Leadership doesn’t disappear; it gets redistributed. In the Security circle, roles are explicit:

• The Business Owner is responsible for elements like strategy, portfolio, and marketing in their domain.
• The People Partner supports people in their development and is a key contact during onboarding.
• The circle lead ensures the circle functions as a system—across skills, training, processes, and roles.

These roles mean no single person must be “everything,” while all crucial dimensions stay covered. For team members, it’s clear who is responsible for what—technically, procedurally, and on the people side.

Cybersecurity as a team sport: breadth and focus

Üblbacher is explicit that cybersecurity spans far beyond traditional perimeter thinking. With rising compliance demands, organizations must prioritize: what is mandated, what makes sense from a risk perspective, what to do today, and what to plan for tomorrow.

In that setting, a structure that empowers autonomous circles with a clear purpose becomes particularly effective. Decisions can be made where the expertise sits—close to customers.

Customer relationships: advisory, protection, and pragmatic dialogue

Bacher Systems’ aim is to make customers “a bit safer” step by step—and do so as a partner. That includes:

• Proactive services and around-the-clock response.
• Early notifications when something emerges.
• Joint evaluation of options—with regard to business processes and impacts.

The webshop example shows that security is not practiced in a vacuum. The technical instinct to isolate a system is understandable, but the business consequences can be severe. Combining technical skill with process awareness is what produces sustainable solutions.

What we’re taking from the session

From the session “Christian Üblbacher, Business Owner Cybersecurity bei Bacher Systems,” we took away three core insights:

1. Structure as an enabler: Holacratic organization with circles, clear roles, and distributed decision-making is not a gimmick. It sets the conditions for fast, focused, customer-centric security work.
2. People before resumes: Recruiting and onboarding prioritize social skills, team fit, and sustainable learning—with People Partners, buddy programs, and individualized training over time.
3. Services with purpose: Companies focus on their core business; Bacher Systems picks up security-critical tasks as a service—proactively, “around the clock,” and always in dialogue with customers’ business processes.

For tech talent, these translate into real opportunities: if you seek ownership, value teamwork, and view security as the linkage of technology, organization, and business, this setup lets you have impact—while keeping people at the center.

Closing: why this approach resonates

The combination of a clear purpose (“sleep well”), circles with genuine autonomy, and recruiting/onboarding that emphasize social competence and long-term learning adds up to a coherent system. Especially in cybersecurity—high in complexity and urgency—you need structures that move decisions to where the expertise is, and support people so they can grow into their roles.

Bacher Systems, as described by Üblbacher, shows what this looks like in practice: circles that operate “like their own company,” People Partners and buddies who center the human element, and services that meet customers where security truly matters—in the reality of their business processes.