https://www.amazon.com/Build-Your-Own-Security-Lab/dp/0470179864
https://www.amazon.com/Penetration-Testing-Hands--Introduction-Hacking/dp/1593275641
https://www.amazon.com/Hacker-Playbook-Practical-Penetration-Testing/dp/1512214566
https://www.giac.org/paper/gsec/2186/building-security-lab-virtual-machines/103719
Note that these are labs focused on offense. Defense is a different beast. Unless you are really dedicated and experienced, I wouldn't bother with a ESX box. VMware Workstation will do fine. Have a box with vulnerable VMs on a decent desktop, and a laptop you can run attacks from windows and Linux.
Well you could go read the books on the subject designed to help people build a lab and learn...
http://www.amazon.com/Build-Your-Own-Security-Lab/dp/0470179864
http://www.amazon.com/Penetration-Testing-Hands--Introduction-Hacking/dp/1593275641
Dude.
http://www.amazon.com/Build-Your-Own-Security-Lab/dp/0470179864
I'll admit that doesn't have much to do with IR though. I'll say for that, buy hard drives from amazon and practice. shouldn't need a bunch of shit.
I mean I hate to be that guy but common sense would have most people google what they are looking for.
Build Your Own Security Lab first result on google for me.
https://www.amazon.com/Build-Your-Own-Security-Lab/dp/0470179864
https://www.amazon.com/Build-Your-Own-Security-Lab/dp/0470179864
This and many other books on the subject will give advice on the subject.
>Would involvement in student organizations and their projects mean much to an employer?
Not really, schools are not built to give you hands on experience. Especially in Pentesting what matters is skill and experience. Take a look at the previous threads on this topic, they discuss a number of additional options for the lab as well as certifications that are relevant.