In my experience, shifting a security culture takes 3 steps:

 1. Get management buy-in to do things differently
 2. Get personal management engagement to lead the way on what is important
 3. Set the tone through training, media, and in-person events that "people like us do things like this"

Here's the thing: management ***has*** to be leading the charge on this, with help with the security champions. Management has to want, and encourage, the technical controls to apply to themselves. If management gets special conditions, game over.

Get a manager, the higher up, the better, to personally and publically express their desire to participate in a properly secure environment. Get them to express the frustrations and inconveniences, too. But also communicate that the inconveniences are important for the health of the company. 

> "I grumble on the mornings when I'm prompted to change my password. I think, I changed it just [1|3] months ago! But, I know that when I do, I'm cutting off a hacker's route to using my credentials to harm me and this company"

[yes, I am aware of the controversy about frequent password changes, but roll with the example for a second]

Then, once you have this great foundation, then start bringing that message to the personal level to everyone.