Is GRC a realistic path for a fresh grad who prefers theoretical cybersecurity?

A recent cybersecurity graduate with a theory-heavy bachelor's degree is seeking career advice after avoiding cyber roles for a year due to lacking practical skills and certifications. The individual dislikes Linux and pentesting but enjoyed theoretical concepts, and is now considering GRC (Governance, Risk, and Compliance) as an entry point. They are concerned about hearing that GRC is not entry-level for fresh graduates and are asking whether studying compliance frameworks like ISO 27001 is the right approach, along with requesting certification recommendations and a roadmap for entry-level GRC positions.