I currently work on the Information Security team at my employer and have been working at my company for about 4 years. Recently a new member joined the team, who per his resume has about 1.5 years of experience in cybersecurity. He has never worked in a SOC before.
I was instructed by my manager to mentor/train this person, but will not be his direct manager going forwards. He is generally smart but has some sloppy work habits that don't really follow best practices. We work with highly sensitive customer credit card, financial, and health data so proper security is essential. Our industry (insurance and healthcare) is tightly regulated.
Some of his actions are "loose" and somewhat "sloppy" such as lapses in communication before making a change to production security components (e.g: firewall, DLP software, IPS, and SIEM etc.), using domain admin credential for system administration tasks that don't require that high level of access, and not logging actions properly in audit logs. While he appears to know what he is doing, I am afraid that such actions may mean he may one day make a critical error in PROD that he may not be able to recover from and I may or may not be able to.
We do have a robust security policy and are a large company. However, I don't want to escalate to my manager yet, as he is new and I want to give him a chance first. When I talked to him about my observations, he stated he is just more used to doing things this way, and it's more efficient.
Question
How can I, without relying on my manager or formal company policy, assist this new team member with changing his behavior?
If informal methods don't work, should I escalate this and how without throwing the new person entirely under the bus?