REST is usually preferred over SOAP for performance reasons. Unless we are planning on running services or consuming them with devices that lack processing power, SOAP should be considered as it has lot of security features / standards. With REST standards are still in the works, and the most recent one and has been submitted to IETF - OAuth WRAP – Web Resource Application Profile.
http://wiki.oauth.net/OAuth-WRAP
REST security will rely mainly on https / TLS and there isn’t any message level security.