What is your opinion on setting up an "Incident Response Retainer" with an IR service provider?

This is essential to have before a major incident occurs.  You don't want to be engaged in a vendor management process or legal oversight process when in the middle of an incident.  Additionally, the retainers are pretty flexible as the hours you pre-purchased can normally be turned into service hours before they expire....ie, assessments, table top exercises, red/blue teams, etc.

It is always a good option to have for that difficult day.  In a real incident situation, SOC is swamped and can be greatly helped by having IR specialists taking over.  There are many service providers in the market and some are top of the league.  Depending on the budget, you should choose.