How to avoid writing clear password in wsdl soap header ?

We consumed a WSDL in Siebel system and configured it in publish. This webservice is invoking and making a call to external middle-ware system Microsoft Biztalk to get financial information from back end systems (Mainframe).

But For PCI/and Operation risk regulation we need to avoid passing the username and password as part of the SOAP Header as a clear text for authentication.

what is the right way to avoid hard coding the username and password in the soap header