Can SOC and GRC be combined into one cybersecurity career path?

A cybersecurity student is asking whether they can combine SOC/Blue Team work with GRC (Governance, Risk, and Compliance) in their career path, as they are interested in both investigating security incidents and working on risk assessment, compliance, and governance. They are considering a potential progression from SOC to GRC/Risk to AI Security/AI Governance, and are willing to learn technical skills like Python, Linux, and SIEM but don't want to become a full-time software developer. They are seeking advice from industry professionals on whether this combination is practical, what job titles to search for, which path to start with, and what skills and certifications would be recommended.