Q:

How to help new team member with security best practices without escalation to management

I currently work on the Information Security team at my employer and have been working at my company for about 4 years. Recently a new member joined the team, who per his resume has about 1.5 years of experience in cybersecurity. He has never worked in a SOC before.
I was instructed by my manager to mentor/train this person, but will not be his direct manager going forwards. He is generally smart but has some sloppy work habits that don't really follow best practices. We work with highly sensitive customer credit card, financial, and health data so proper security is essential. Our industry (insurance and healthcare) is tightly regulated.
Some of his actions are "loose" and somewhat "sloppy" such as lapses in communication before making a change to production security components (e.g: firewall, DLP software, IPS, and SIEM etc.), using domain admin credential for system administration tasks that don't require that high level of access, and not logging actions properly in audit logs. While he appears to know what he is doing, I am afraid that such actions may mean he may one day make a critical error in PROD that he may not be able to recover from and I may or may not be able to.
We do have a robust security policy and are a large company. However, I don't want to escalate to my manager yet, as he is new and I want to give him a chance first. When I talked to him about my observations, he stated he is just more used to doing things this way, and it's more efficient.
Question

How can I,  without relying on my manager or formal company policy, assist this new team member with changing his behavior?
If informal methods don't work, should I escalate this and how without throwing the new person entirely under the bus?

A:

[...]used to doing things this way, and its more efficient.

Every time he violates a policy point it out to him in a friendly but serious manner.
If he answers similarly again or even while you point it out, tell him "it may not be the most effective way" or "you know it's a hassle to do this way" or "yeah, it is cumbersome"
BUT 
"it is the protocol", "is required by law or the policy" or "has to be done here without exception".
Make sure he understands that you all had to change habit to adapt policies and that they're enforced by management for a reason.
If applicable give an example of what could go wrong and / or what his punishment or consequences would be for him, the team and the comany.
If you see after a couple of instances that he won't change, create a paper trail by sending "helpful" email reminders.

"as per our discussion today" 
  or 
"when I mentioned we need to do X instead of Y" or 
"hey, do you remember when you did X and I said Z could happen"

...and then follow up by citing or explaining / quoting

a similar case you read on the internet
a section of the policy hand book
an applicable law regarding his infraction
a security article in a journal

Follow up by reiterating what you said to him earlier.
This way, you're not admonishing him (taking on a superior position to your peer that you don't have), simply guiding him and showing effort to be helpful to him.
You'll probably get through with less resistance AND in case he ever screws up or you end up having to eventually escalate his negligence to management or security or a superior witnesses him doing something and asks you if you told him it was not allowed, you can present proof of your mentoring and your instructing him on the company policy.
Also, remember, you have no leadership position so you can't really enforce his change in behaviour, only show him how it is expected to be done at your company.
If he ever causes an incident, it is not your responsibility what another adult does who is not your subordinate (even then there are limits).

