This sounds like a re-architecture may be required. As Crovers mentioned above, you will not be able to protect the username and password if they are stored locally on the device. You will need some form of proxy in between the web service endpoint and the device.
Best practice would be to give each user his or her own credential for the proxy, and then the proxy itself would connect the the SOAP endpoint. The Proxy would connect to the SOAP Service via SSL
A not recommended work-around
Depending on your security requirements, you may be able to get away with less stringent requirements. If there are particular operations on the SOAP service that you do not want your users to be able to access, you can simply not expose them via the proxy application. For example, if the SOAP service exposes an add, an edit, and a delete operation, and you don't want your end users to use the delete operation, your proxy application would not expose a delete operation to your users. Please note that this solution will only work with vertical access control, and not horizontal access control. It will only prevent users from performing unauthorized actions, such as the delete example. It will not prevent users from performing authorized actions against object which they should not be able to access (i.e. If I can update my records, I can also update your records.)
I hope that helps. Please go with the best practice if at all possible.