Here are a few code samples that could help : 
 

Class YourPackage.REST.CSoapAuthenticator Extends %CSP.REST
{

Parameter CONTENTTYPE = "text/xml";
XData UrlMap [ XMLNamespace = "http://www.intersystems.com/urlmap" ]
{
<Routes>
<Route Url="/:soapService" Method="POST" Call="PostSOAP"/>
</Routes>
}

ClassMethod PostSOAP(
    strSoapService As %String = "",
    test As %Integer = 0) As %Status
{
   #Dim %request As %CSP.Request
   #Dim %response As %CSP.Response
   #Dim httpClient As %Net.HttpRequest = ..GetLoopbackSOAPClient()
   do httpClient.EntityBody.Write(..UpdateSoapBody(%request.Content.Read($$$MaxStringLength)))
   do httpClient.SetHeader("SOAPAction", %request.SoapAction)
   do httpClient.Post($System.CSP.GetDefaultApp($Namespace) _ "/" _ strSoapService, test)

   set %response.ContentType = "text/xml"
   write httpClient.HttpResponse.Data.Read($$$MaxStringLength)

   return $$$OK
}

// -- Private utils --
ClassMethod GetLoopbackSOAPClient() As %Net.HttpRequest [ Private ]
{
   set httpClient = ##class(%Net.HttpRequest).%New()
   set httpClient.Server = ...
   set httpClient.Port = ...
   set httpClient.Timeout = 5
   set httpClient.Https = 1
   set httpClient.SSLConfiguration = ...
  
   return httpClient
}

ClassMethod UpdateSoapBody(strInput As %String) As %String [ Private ]
{
   #Dim strSoap As %String = ""
   #Dim username As %String = ... (Extract from Input)
   #Dim password As %String = ... (Extract from Input)
   
   set strSoap = strSoap _ ... (Copy soap enveloppe from input)
   set strSoap = strSoap _ " <soap:Header>" _ ..GenerateSecurityHeader(username, password) _ " </soap:Header>"
   set strSoap = strSoap _ " <soap:Body>"
   ... 
   set strSoap = strSoap _ " </soap:Body>"
   set strSoap = strSoap _ "</soap:Envelope>"
   return strSoap
}

ClassMethod GenerateSecurityHeader(
    strUsername As %String,
    strPassword As %String) As %String [ Private ]
{
   set header = ##class(%SOAP.Security.Header).%New()
   set usernameToken = ##class(%SOAP.Security.UsernameToken).Create(strUsername, strPassword)
   do header.AddSecurityElement(usernameToken)

   return ... (Use XML Writer to Output header to a String.)
}

}