I am new to InfoSec role, and not really sure if it includes responsibility for monitoring: that's, when we write policies and procedures, who is checking whether they've been obeyed or not? Is it internal audit, is it InfoSec?
It can be either, depending on the purpose of the monitoring.
InfoSec needs to monitor in order to respond to issues quickly and efficiently so that risks are limited right now.
Governance, Compliance, and Audit will want to monitor in order to ensure that the controls, processes, and policies are working as intended and having the intended effect over time.
However, every organisation can have different resources and needs, and Infosec might also gather and review data for compliance and audit purposes. This is most common in small orgs with small teams where only the infosec people really understand the compliance issues and what the data means.
Agreed with the above answer. I'm new to a security role as well. In the company that I work for and part of the work that my team is involved in is creating the policies and procedures.
But, we also monitor and follow up on anything that has been logged or blocked as a result of the enforced policies.