Do I need technical staff to offer security monitoring?

Less than you would think for the monitoring; more than none for the follow-up:

• The scanning needs nobody - it runs continuously and produces findings without interpretation.
• The findings are written to be readable - each one states what it is, why it matters and what to change.
• The remediation is the skilled part - some fixes are a DNS record, others belong with the client’s host or developer.

Many agencies sell the monitoring and the plain-English report, and pass the technical fixes to whoever already maintains the site.