Not OP, but my company is looking, so: The right mindset. Skills can be acquired. But dealing with an intelligent, intentionally acting adversary is fundamentally different from dealing with technical failures, environment events or simple system behaviour. This is also where in the training scenarios I sometimes run most companies fail. They can handle a fire, a DDoS attack, a malware outbreak - but they can't handle a hacker who will pivot and react to whatever you're doing. Having a basic grasp of what it means to be under attack is essential.