Two sandboxes. One pretends to be the attacker; the other pretends to be everyone trying to catch the attacker. Pick the side you need the most practice on.
Break things on purpose, in a sandbox, so you don't break them by accident in production. Web, smart contract, network attacks, and a story-driven CTF.
Sharpen the eyes that read logs, tune alerts, and pull signal from telemetry noise. Read the trail, write the rule, walk the timeline.