Both the recording handler and the memory buffer recorder do not change the messages while handling them. As you pointed out, it's only a matter of the handler's position in the handler chain, since the incoming message's security header is removed by the security handler once it has processed the message. So if you need to log that header, the recording handler has to run before the security one.
When changing the handler chain, please note that the security handler is a POST handler. This means that to run the recording handler first, this need to be configured as a POST handler too (and put first in the list, of course).