The video, XPath and XQuery assertions in SoapUI in depth, drew my attention to SoapUI, but be forewarned the sound quality was so bad I could not follow it. Still, I can now mention SoapUI and that’s not a bad thing.
The SoapUI documentation has extended examples for Validating XML Messages, Getting started with Assertions, and Transferring Property Values.
SoapUI has the usual hand-waving about security but since critical airport security plans can be found USB litter, I’m not sure anyone bothers. Your Amazon account root password is probably on a sticky note on someone’s monitor. Go check.