"but I'm not sure how to get started or how to present it to my upper management. Can you give me some advice?"

1. Assess where the  Dev-Teams and Sec-Teams are (Does the Developer have security experience and expertise and vice versa)
2. Provide training to both groups (address their weaknesses)
3. Bring in a professional to provide guidance to that particular group who is lacking in certain areas (online training and in-person, people learn differently).
4. Put the groups in scenarios to determine where they are in their development process
• Have the Dev-Team engage in a quarterly or semi-annually security simulation where the managers capture stats on how the team performs
• Bring the Sec-Team and have them address a programming problem, individually and as a group
5. Put together information from the Mitre Att&ck info (security), CMMI (programming guide) along with OWASP
6. Provide incentives on achieving their goals (monetary and leadership roles)
7. Create a data-sharing model where both groups work together to cross-pollinate learning objectives, create a mentor program for both groups
8. Meet every week to determine their progress and testing process
9. Document this process where this is considered a framework for future HR projects (start, problems, mitigation procedures, lessons learned and development strategies)