If you are writing both the client and server, you do not need a WSDL file.
If you intend to publish your service for others to consume, you are better off creating a WSDL file as this will be the "standard" for consuming your service. If anybody wants to consume your service, they will have to conform to your standard.
You can implement WSSecurity without a WSDL file. Generally, WSSecurity is not included in the WSDL file as you want security done "Out-Of-Band".