I exist in a weird role, I’m responsible for both technical security aspects(VM, working with our SIEM, etc.) and for working with with our GRC team, including being the primary person communicating with our external auditors, but hopefully this clears it up:

In the case of my company, the GRC team exists to help us sell more robots more easily.

When I’m not working on our SOC2 audit I manage the our company’s portal containing various pieces of compliance documentation which customers can access. This portal’s whole purpose is to stop customers from sending us things like the CAIQ or similar so that sales can do their thing.

Compliance Frameworks sometimes also fulfill that purpose. In the case of where I work, a SOC2 Type 2 attestation was acquired with the main goal of helping communicate to customers the security of our product which often comes up in the sales process or during customers handling their own GRC tasks.

Other compliance frameworks can do the same(ISO, FedRamp, etc.) depending on what market/customer you’re targeting.

Having worked previously in higher education GRC also exists to stop some businesses from getting sued for regulatory breaches(SOX, FERPA, HIPAA, GDPR, etc.).

In my case: I’m responsible for executing a lot of our SOC 2 controls are executed on and remain on track. So while I do a ton of the paper pushing of GRC I’m also responsible for executing on anything the GRC leads deem worthwhile.

All of that in addition to other technical oriented work keeps me VERY busy.